CVE-2025-30471
Published: 31 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-30471 is a validation issue, classified under CWE-20 for improper input validation, that was addressed by Apple with improved validation logic. The vulnerability affects multiple Apple operating systems and platforms, including iOS versions prior to 18.4, iPadOS versions prior to 18.4 and 17.7.6, macOS Sequoia prior to 15.4, macOS Sonoma prior to 14.7.5, macOS Ventura prior to 13.7.5, tvOS prior to 18.4, visionOS prior to 2.4, and watchOS prior to 11.4. It was published on 2025-03-31.
A remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no privileges, no user interaction, and no change in scope, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation allows the attacker to cause a denial-of-service condition on the targeted device, disrupting availability without impacting confidentiality or integrity.
Apple's security advisories detail the fixes in the specified update versions. Mitigation involves applying these patches promptly, with further details available in the release notes at https://support.apple.com/en-us/122371, https://support.apple.com/en-us/122372, https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a remote network-exploitable improper input validation flaw (CWE-20) that causes denial-of-service on Apple endpoints with no privileges or user interaction required, directly enabling T1499.004 (Application or System Exploitation) under Endpoint Denial of Service.