CVE-2025-24085
published 2025-01-27CVE-2025-24085: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS…
PriorityP192critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-02-19
Exploited in the wild
EPSS
18.67%
96.9th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_18.3_and_ipados | — | — |
| apple | ios_and_ipados | < 18.3 | 18.3 |
| apple | ipados | < 17.7.6 | 17.7.6 |
| apple | ipados | — | — |
| apple | ipados | >= 18.0 < 18.3 | 18.3 |
| apple | iphone_os | < 18.3 | 18.3 |
| apple | macos | < 13.7.5 | 13.7.5 |
| apple | macos | < 14.7.5 | 14.7.5 |
| apple | macos | < 15.3 | 15.3 |
| apple | macos | >= 13.0 < 13.7.5 | 13.7.5 |
| apple | macos | >= 14.0 < 14.7.5 | 14.7.5 |
| apple | macos | >= 15.0 < 15.3 | 15.3 |
| apple | macos_sequoia | — | — |
| apple | macos_sonoma | — | — |
| apple | macos_ventura | — | — |
| apple | tvos | < 18.3 | 18.3 |
| apple | tvos | — | — |
| apple | visionos | < 2.3 | 2.3 |
| apple | visionos | — | — |
| apple | watchos | < 11.3 | 11.3 |
| apple | watchos | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2025-24085 is a use-after-free in CoreMedia (Apple) actively exploited against iOS versions before 17.2 via a malicious application to elevate privileges. Monitor for privilege escalation from sandboxed app processes. ↗
- →Alert on creation of hidden files under /tmp/ with names beginning with a dot (e.g., .rootbash, .macroot_payload.sh) combined with setuid bit (chmod +s) being applied, as this is a post-exploitation persistence pattern for this CVE's PoC. ↗
- →Detect use of sysadminctl to add new admin users from non-interactive or scripted contexts, which may indicate post-exploitation persistence following privilege escalation. ↗
- ·The Exploit-DB PoC (exploit 52316) is attributed to a third-party researcher and targets macOS via LaunchDaemon hijacking. The original in-the-wild exploitation vector against iOS before 17.2 is not publicly detailed by Apple; the PoC may not reflect the actual exploitation technique used in targeted attacks. ↗
- ·Apple has not shared further details on how the flaw was exploited in the wild; detection based on the PoC should be treated as covering one possible exploitation path, not confirmed attacker TTPs. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2025-24085: macOS Sonoma 14.7.5
vendor_apple·2025-03-31·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: macOS Sonoma 14.7.5
Apple Security Update: About the security content of macOS Sonoma 14.7.5
Product: macOS Sonoma
Version: 14.7.5
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: iPadOS 17.7.6
vendor_apple·2025-03-31·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: iPadOS 17.7.6
Apple Security Update: About the security content of iPadOS 17.7.6
Product: iPadOS
Version: 17.7.6
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: macOS Ventura 13.7.5
vendor_apple·2025-03-31·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: macOS Ventura 13.7.5
Apple Security Update: About the security content of macOS Ventura 13.7.5
Product: macOS Ventura
Version: 13.7.5
CVE: CVE-2025-24085
Component: CVE-2025-24085
CISA
Apple Multiple Products Use-After-Free Vulnerability
cisa·2025-01-29·CVSS 10.0
CVE-2025-24085 [CRITICAL] CWE-416 Apple Multiple Products Use-After-Free Vulnerability
Vulnerability: Apple Multiple Products Use-After-Free Vulnerability
Affected: Apple Multiple Products
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://support.apple.com/en-us/122066 ; https://support.apple.com/en-us/122068 ; https://support.apple.com/en-us/122071 ; https://support.apple.com/en-us/122072 ; https://support.apple.com/en-us/122073 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24085
Remediation Due Date: 2025-02-19
Apple
CVE-2025-24085: tvOS 18.3
vendor_apple·2025-01-27·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: tvOS 18.3
Apple Security Update: About the security content of tvOS 18.3
Product: tvOS
Version: 18.3
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: watchOS 11.3
vendor_apple·2025-01-27·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: watchOS 11.3
Apple Security Update: About the security content of watchOS 11.3
Product: watchOS
Version: 11.3
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: iOS 18.3 and iPadOS 18.3
vendor_apple·2025-01-27·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: iOS 18.3 and iPadOS 18.3
Apple Security Update: About the security content of iOS 18.3 and iPadOS 18.3
Product: iOS 18.3 and iPadOS
Version: 18.3
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: visionOS 2.3
vendor_apple·2025-01-27·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: visionOS 2.3
Apple Security Update: About the security content of visionOS 2.3
Product: visionOS
Version: 2.3
CVE: CVE-2025-24085
Component: CVE-2025-24085
Apple
CVE-2025-24085: macOS Sequoia 15.3
vendor_apple·2025-01-27·CVSS 10.0
CVE-2025-24085 [CRITICAL] CVE-2025-24085: macOS Sequoia 15.3
Apple Security Update: About the security content of macOS Sequoia 15.3
Product: macOS Sequoia
Version: 15.3
CVE: CVE-2025-24085
Component: CVE-2025-24085
GHSA
GHSA-7h23-57pg-3hwc: A use after free issue was addressed with improved memory management
ghsa_unreviewed·2025-01-28
CVE-2025-24085 [HIGH] CWE-276 GHSA-7h23-57pg-3hwc: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
VulnCheck
Apple Multiple Products Use-After-Free Vulnerability
vulncheck·2025·CVSS 10.0
CVE-2025-24085 [CRITICAL] CWE-416 Apple Multiple Products Use-After-Free Vulnerability
Apple Multiple Products Use-After-Free Vulnerability
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Affected: Apple Multiple Products
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://support.apple.com/en-us/122066; https://support.apple.com/en-us/122068; https://support.apple.com/en-us/122071; https://support.apple.com/en-us/122072; https://support.apple.com/en-us/122073; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://support.apple.com/en-us/12237
No detection rules found.
Bleepingcomputer
Apple fixes two zero-day flaws exploited in 'sophisticated' attacks
blogs_bleepingcomputer·2025-12-12·CVSS 8.8
CVE-2025-43529 [HIGH] Apple fixes two zero-day flaws exploited in 'sophisticated' attacks
## Apple fixes two zero-day flaws exploited in 'sophisticated' attacks
## Lawrence Abrams
CVE-2025-43529 is a WebKit use-after-free remote code execution flaw that can be exploited by processing maliciously crafted web content. Apple says the flaw was discovered by Google’s Threat Analysis Group.
CVE-2025-14174 is a WebKit memory corruption flaw that could lead to memory corruption. Apple says the flaw was discovered by both Apple and Google’s Threat Analysis Group.
Devices impacted by both flaws include:
iPhone 11 and later
iPad Pro 12.9-inch (3rd generation and later)
iPad Pro 11-inch (1st generation and later)
iPad Air (3rd generation and later)
iPad (8th generation and later)
iPad mini (5th generation and later)
Apple has fixed the flaws in iOS 26.2 and iPadOS 26.2, iOS 18.7
Bleepingcomputer
Apple backports zero-day patches to older iPhones and iPads
blogs_bleepingcomputer·2025-09-16·CVSS 10.0
[CRITICAL] Apple backports zero-day patches to older iPhones and iPads
## Apple backports zero-day patches to older iPhones and iPads
## Sergiu Gatlan
An out-of-bounds write occurs when attackers supply maliciously crafted input to a program that causes it to write data outside the allocated memory buffer, potentially triggering crashes, corrupting data, or even allowing remote code execution.
Apple has now addressed this zero-day flaw in iOS 15.8.5 / 16.7.12, as well as iPadOS 15.8.5 / 16.7.12, with improved bounds checks.
"Processing a malicious image file may result in memory corruption. An out-of-bounds write issue was addressed with improved bounds checking," the company said in Monday advisories .
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals."
The lis
Bleepingcomputer
Apple fixes new zero-day flaw exploited in targeted attacks
blogs_bleepingcomputer·2025-08-20·CVSS 10.0
[CRITICAL] Apple fixes new zero-day flaw exploited in targeted attacks
## Apple fixes new zero-day flaw exploited in targeted attacks
## Sergiu Gatlan
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals," the company revealed in security advisories issued on Wednesday.
"An out-of-bounds write issue was addressed with improved bounds checking. Processing a malicious image file may result in memory corruption."
Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 18.6.2 and iPadOS 18.6.2 , iPadOS 17.7.10 , macOS Sequoia 15.6.1 , macOS Sonoma 14.7.8 , and macOS Ventura 13.7.8 .
The complete list of devices impacted by this zero-day vulnerability is extensive, as the bug impacts both older and newer models, including:
iPhone XS a
Bleepingcomputer
Apple patches security flaw exploited in Chrome zero-day attacks
blogs_bleepingcomputer·2025-07-30·CVSS 8.8
CVE-2025-6558 [HIGH] Apple patches security flaw exploited in Chrome zero-day attacks
## Apple patches security flaw exploited in Chrome zero-day attacks
## Sergiu Gatlan
Vlad Stolyarov and Clément Lecigne of Google's Threat Analysis Group (TAG), a team of security experts dedicated to defending Google customers against state-sponsored attacks, discovered CVE-2025-6558 in June and reported it to the Google Chrome team, who patched it on July 15 and tagged it as actively exploited in attacks.
While Google has yet to provide further information on these attacks, Google TAG frequently discovers zero-day flaws exploited by government-sponsored threat actors in targeted campaigns aimed at deploying spyware on devices of high-risk individuals, including dissidents, opposition politicians, and journalists.
On Tuesday, Apple released WebKit security updates to address the CVE-2
Bleepingcomputer
Apple fixes two zero-days exploited in targeted iPhone attacks
blogs_bleepingcomputer·2025-04-16·CVSS 10.0
CVE-2025-31200 [CRITICAL] Apple fixes two zero-days exploited in targeted iPhone attacks
## Apple fixes two zero-days exploited in targeted iPhone attacks
## Lawrence Abrams
The CVE-2025-31200 flaw in CoreAudio was discovered by Apple and the Google Threat Analysis team. It can be exploited by processing an audio stream in a maliciously crafted media file to execute remote code on the device.
The company also fixed CVE-2025-31201, which Apple discovered. It is a bug in RPAC that allows attackers with read or write access to bypass Pointer Authentication (PAC), an iOS security feature that helps protect against memory vulnerabilities.
Apple has not shared further details on how the flaws were exploited in attacks. BleepingComputer contacted Apple and Google with questions about flaws but has not received a response.
Both vulnerabilities were fixed in iOS 18.4.1 , iPadOS 18
Checkpoint
7th April – Threat Intelligence Report
blogs_checkpoint·2025-04-07
CVE-2024-20439 7th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 7th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 7th April, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The second-largest bar association in the US, The State Bar of Texas, has experienced a ransomware attack that resulted in unauthorized access to its network, exposing sensitive member information including full names and legal case documents. The INC ransomware gang claimed responsibility for the attack and has already leaked
Bleepingcomputer
Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
blogs_bleepingcomputer·2025-03-11·CVSS 7.8
CVE-2025-24201 [HIGH] Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
## Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
## Sergiu Gatlan
Apple said attackers can exploit the CVE-2025-24201 vulnerability using maliciously crafted web content to break out of the Web Content sandbox.
The company has fixed this out-of-bounds write issue with improved checks to prevent unauthorized actions in iOS 18.3.2, iPadOS 18.3.2 , macOS Sequoia 15.3.2 , visionOS 2.3.2 , and Safari 18.3.1 .
The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including:
iPhone XS and later,
iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Macs
Bleepingcomputer
Apple fixes zero-day exploited in 'extremely sophisticated' attacks
blogs_bleepingcomputer·2025-02-10·CVSS 7.8
[HIGH] Apple fixes zero-day exploited in 'extremely sophisticated' attacks
## Apple fixes zero-day exploited in 'extremely sophisticated' attacks
## Sergiu Gatlan
USB Restricted Mode is a security feature ( introduced almost seven years ago in iOS 11.4.1) that blocks USB accessories from creating a data connection if the device has been locked for over an hour. This feature is designed to block forensic software like Graykey and Cellebrite (commonly used by law enforcement) from extracting data from locked iOS devices.
In November, Apple introduced another security feature (dubbed "inactivity reboot") that automatically restarts iPhones after long idle times to re-encrypt data and make it harder to extract by forensic software.
The zero-day vulnerability (tracked as CVE-2025-24200 and reported by Citizen Lab's Bill Marczak) patched today by Apple is an author
https://support.apple.com/en-us/122066https://support.apple.com/en-us/122068https://support.apple.com/en-us/122071https://support.apple.com/en-us/122072https://support.apple.com/en-us/122073https://support.apple.com/en-us/122372https://support.apple.com/en-us/122374https://support.apple.com/en-us/122375http://seclists.org/fulldisclosure/2025/Apr/10http://seclists.org/fulldisclosure/2025/Apr/5http://seclists.org/fulldisclosure/2025/Apr/9http://seclists.org/fulldisclosure/2025/Jan/12http://seclists.org/fulldisclosure/2025/Jan/13http://seclists.org/fulldisclosure/2025/Jan/15http://seclists.org/fulldisclosure/2025/Jan/19http://seclists.org/fulldisclosure/2025/Jun/19http://seclists.org/fulldisclosure/2025/Oct/1http://seclists.org/fulldisclosure/2025/Oct/23http://seclists.org/fulldisclosure/2025/Oct/30http://seclists.org/fulldisclosure/2025/Oct/31https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201https://github.com/cisagov/vulnrichment/issues/194https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24085
2025-01-27
Published
2025-01-29
Added to CISA KEV
Exploited in the wild