CVE-2025-24201

HIGH

Published 2025-03-11T18:07:21.848Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-24201. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

7.1

/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.000

probability

of exploitation in the wild

There is a 0.0% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.153

Higher than 15.3% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Available Exploits

No exploits available for this CVE.

Posted by josephgoyd via Fulldisclosure on Jun 17"Glass Cage" – Sophisticated Zero-Click iMessage Exploit ChainEnabling Persistent iOS Compromise and Device Bricking CVE-2025-24085, CVE-2025-24201(CNVD-2025-07885) Author: Joseph Goydish II Date: 06/10/2025 …

Seclists.org 2025-06-18 03:07

Affected Products

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

April 3, 2025

Added to KEV

March 13, 2025

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: Apple

Product: Multiple Products

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.04.11 Released: April 11, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-2j99-5q75-3f57

Advisory Details

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-24201

WEB https://support.apple.com/en-us/122281

WEB https://support.apple.com/en-us/122283

WEB https://support.apple.com/en-us/122284

WEB https://support.apple.com/en-us/122285

WEB https://support.apple.com/en-us/122345

WEB https://support.apple.com/en-us/122346

WEB https://support.apple.com/en-us/122372

WEB https://support.apple.com/en-us/122376

WEB http://seclists.org/fulldisclosure/2025/Apr/16

WEB http://seclists.org/fulldisclosure/2025/Mar/2

WEB http://seclists.org/fulldisclosure/2025/Mar/3

WEB http://seclists.org/fulldisclosure/2025/Mar/4

WEB http://seclists.org/fulldisclosure/2025/Mar/5

Advisory provided by GitHub Security Advisory Database. Published: March 11, 2025, Modified: April 13, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

6 posts

Reddit • 2 weeks, 2 days ago

Sarunas

Prancūzija atskleidžia „Apple“ šnipinėjimo veiklą Prancūzijos nacionalinė kibernetinio saugumo agentūra ANSSI paskelbė, kad „Apple“ neseniai išsiuntė pranešimus naudotojams, kuriuos taikiniu pasirinko šnipinėjimo programos. Nuo 2021 m. „Apple“ siunčia tokio pobūdžio įspėjimus, tačiau jie yra individualūs ir neviešinami, todėl sunku nustatyti, kada atakos vyksta ir ar jos sutampa su nulinių dienų …

Also mentions: CVE-2025-43300

3.0

View Original

Reddit • 2 months ago

CyborgParadox

Exploit PoC

CVE-2025-24201 Would love to find a poc exploit or for CVE-2025-24201 or how I could go about creating one. It is the only thing patched on iOS 18.3.2 https://support.apple.com/en-us/122281

19.0

View Original High Risk

Reddit • 3 months ago

DisciplineCandid9707

Exploit

Potential Userland ROP exploit in the Switch 1/2 via CVE-2025-24201 ? So maybe softmod of the switch 1 mariko a exploit like the GoldHen on the PS4

6.0

View Original High Risk

Reddit • 3 months ago

XTRevivals

Exploit

Potential Userland ROP exploit for Switch 2 via CVE-2025-24201 ? While I don't know what webkit version the Switch 2 version uses or the Switch 1 uses, we could potentially use exploit CVE-2025-24201 According to Redhat Security about the exploit CVE-2025-24201: [https://access.redhat.com/security/cve/cve-2025-24201](https://access.redhat.com/security/cve/cve-2025-24201) >A flaw was found in WebKitGTK. Processing malicious …

134.0

View Original High Risk

Reddit • 3 months, 2 weeks ago

crstux

🔥 Top 10 Trending CVEs (15/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2024-43468](https://nvd.nist.gov/vuln/detail/CVE-2024-43468)** - 📝 Microsoft Configuration Manager Remote Code Execution Vulnerability - 📅 **Published:** 08/10/2024 - 📈 **CVSS:** 9.8 - 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - 📣 **Mentions:** 11 - ⚠️ **Priority:** 2 --- …

Also mentions: CVE-2025-32717 CVE-2025-32711 CVE-2025-33053 CVE-2025-33073 CVE-2025-49113 CVE-2025-21420 CVE-2024-57727 CVE-2024-43468

2.0

View Original

Reddit • 3 months, 2 weeks ago

crstux

🔥 Top 10 Trending CVEs (14/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-24201](https://nvd.nist.gov/vuln/detail/CVE-2025-24201)** - 📝 An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, …