Cyber Posture

CVE-2025-24201

CriticalCISA KEVActive Exploitation

Published: 11 March 2025

Published
11 March 2025
Modified
03 April 2026
KEV Added
13 March 2025
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0024 46.8th percentile
Risk Priority 40 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2025-24201 is an out-of-bounds write vulnerability (CWE-787) that was addressed through improved bounds checks to prevent unauthorized actions. It affects the Web Content sandbox in Safari and multiple Apple platforms, including iOS versions prior to 15.8.4, 16.7.11, and 18.3.2; iPadOS versions prior to 15.8.4, 16.7.11, 17.7.6, and 18.3.2; macOS Sequoia prior to 15.3.2; visionOS prior to 2.3.2; and watchOS prior to 11.4. Maliciously crafted web content may exploit the issue to break out of the Web Content sandbox.

Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction (CVSS:3.1 score of 10.0; AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Successful exploitation enables breakout from the sandbox, potentially granting high-impact access to confidentiality, integrity, and availability on the affected device.

Apple security advisories detail patches in the listed versions, including Safari 18.3.1 and corresponding OS updates, available via https://support.apple.com/en-us/122281, https://support.apple.com/en-us/122283, https://support.apple.com/en-us/122284, https://support.apple.com/en-us/122285, and https://support.apple.com/en-us/122345. Security practitioners should prioritize updating affected devices.

This issue serves as a supplementary fix for an attack blocked in iOS 17.2. Apple is aware of a report that it may have been exploited in an extremely sophisticated attack targeting specific individuals on iOS versions prior to 17.2.

Details

CWE(s)
CWE-787
KEV Date Added
13 March 2025

Affected Products

apple
safari
≤ 18.3.1
apple
macos
15.0 — 15.3.2
apple
visionos
≤ 2.3.2
apple
watchos
≤ 11.4
apple
ipados
15.8 — 15.8.4 · 16.7 — 16.7.11 · 17.0 — 17.7.6
apple
iphone os
15.8 — 15.8.4 · 16.7 — 16.7.11 · 17.0 — 18.3.2
debian
debian linux
11.0

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Out-of-bounds write in Safari Web Content sandbox allows malicious web content to escape sandbox with no user interaction, directly enabling drive-by compromise via crafted web content and exploitation for client execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References