Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.

Published
Last modified
published
Listed in CISA KEV
Fix
Fixed in 18.3.1, 15.8.4, 16.7.11, 18.3.2, 17.7.6, and 3 more
None on Exploit-DB, Metasploit or GitHub

Summary

Apple Safari and the iOS, iPadOS, macOS Sequoia, visionOS, and watchOS operating systems are affected. Maliciously crafted web content could break out of the Web Content sandbox and perform actions it should not be allowed to take.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated

Affected versions

  • Apple Safari

    fixed in 18.3.1

  • Apple iOS and iPadOS

    fixed in 15.8.4; fixed in 16.7.11; fixed in 18.3.2

  • Apple iPadOS

    fixed in 17.7.6

  • Apple macOS

    fixed in 15.3.2

  • Apple visionOS

    fixed in 2.3.2

  • Apple watchOS

    fixed in 11.4

References 8

support.apple.com