CVE-2025-24201

HIGH

Published 2025-03-11T18:07:21.848Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-24201. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

7.1

/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Available Exploits

No exploits available for this CVE.

Posted by josephgoyd via Fulldisclosure on Jun 17"Glass Cage" – Sophisticated Zero-Click iMessage Exploit ChainEnabling Persistent iOS Compromise and Device Bricking CVE-2025-24085, CVE-2025-24201(CNVD-2025-07885) Author: Joseph Goydish II Date: 06/10/2025 …

Seclists.org 2025-06-18 03:07

Affected Products

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

April 3, 2025

Added to KEV

March 13, 2025

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: Apple

Product: Multiple Products

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.04.11 Released: April 11, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-2j99-5q75-3f57

Advisory Details

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-24201

WEB https://support.apple.com/en-us/122281

WEB https://support.apple.com/en-us/122283

WEB https://support.apple.com/en-us/122284

WEB https://support.apple.com/en-us/122285

WEB https://support.apple.com/en-us/122345

WEB https://support.apple.com/en-us/122346

WEB https://support.apple.com/en-us/122372

WEB https://support.apple.com/en-us/122376

WEB http://seclists.org/fulldisclosure/2025/Apr/16

WEB http://seclists.org/fulldisclosure/2025/Mar/2

WEB http://seclists.org/fulldisclosure/2025/Mar/3

WEB http://seclists.org/fulldisclosure/2025/Mar/4

WEB http://seclists.org/fulldisclosure/2025/Mar/5

Advisory provided by GitHub Security Advisory Database. Published: March 11, 2025, Modified: April 13, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

2 posts

Reddit • 4 days, 1 hour ago

crstux

🔥 Top 10 Trending CVEs (15/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2024-43468](https://nvd.nist.gov/vuln/detail/CVE-2024-43468)** - 📝 Microsoft Configuration Manager Remote Code Execution Vulnerability - 📅 **Published:** 08/10/2024 - 📈 **CVSS:** 9.8 - 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - 📣 **Mentions:** 11 - ⚠️ **Priority:** 2 --- …

Also mentions: CVE-2025-32717 CVE-2025-32711 CVE-2025-33053 CVE-2025-33073 CVE-2025-49113 CVE-2025-21420 CVE-2024-57727 CVE-2024-43468

2.0

View Original

Reddit • 5 days, 1 hour ago

crstux

🔥 Top 10 Trending CVEs (14/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-24201](https://nvd.nist.gov/vuln/detail/CVE-2025-24201)** - 📝 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, …