CVE-2025-24177
Published: 27 January 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-24177 is a null pointer dereference vulnerability (CWE-476) that was addressed through improved input validation in multiple Apple operating systems. The affected software includes iOS versions prior to 18.3, iPadOS versions prior to 18.3 and 17.7.6, macOS Sequoia prior to 15.3, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. Published on 2025-01-27, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An attacker on the local network can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Exploitation leads to a denial-of-service condition, impacting availability while having no effect on confidentiality or integrity.
Apple's security advisories detail the fixes in the specified updates: iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Additional information is available at https://support.apple.com/en-us/122066, https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122372, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Null pointer dereference vulnerability exploitable over the network to cause denial-of-service via application/system crash, directly mapping to Endpoint Denial of Service through Application or System Exploitation.