Microsoft points at Apple bug, while its own flaws go wild

While Microsoft is dealing with criticism over two of its own bugs being actively used in attacks, it has now highlighted a security flaw it discovered in Apple’s macOS earlier this year.

The bug, called Sploitlight, was fixed by Apple back in March. It allowed attackers to steal personal data through Apple’s built-in search feature, Spotlight. Although the issue is patched, Microsoft recently published a detailed report on it months after the fix.

What Was the Apple Bug?

The flaw, officially tracked as CVE-2025-31199, could have been dangerous if left unpatched. It allowed attackers to access sensitive information like location history, photo and video data, face recognition info, and search habits.

Microsoft says the problem came from how Spotlight uses plugins to scan and index files. Attackers could trick these plugins into bypassing Apple’s privacy controls and accessing data they shouldn’t see.

Because Apple devices share data through iCloud, someone who gained access to a Mac could even view synced info from an iPhone or iPad.

Apple’s TCC system which is designed to protect user data has been breached before. Earlier hacks like Powerdir and HM-Surf found similar loopholes to access private data without permission. Apple has not responded to Microsoft’s recent report about Sploitlight.

The bug was real, and it’s good that it was fixed. But why did Microsoft choose to release the details now?

Just last week, Microsoft admitted that its July software update didn’t fully fix two dangerous bugs in SharePoint Server. Attackers are actively using those flaws to breach organizations—including the U.S. Energy Department. Chinese government hackers, cybercriminals, and ransomware groups are reportedly involved.

So Microsoft’s detailed report on an old Apple bug feels a bit like a distraction—“look over there, not here.”

When asked about the timing, Microsoft said it worked with Apple to ensure the patch was complete and followed responsible disclosure rules.