⚠ Actively exploited
Added to CISA KEV on 2025-03-13. Federal agencies required to patch by 2025-04-03. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-24201 — Out-of-bounds Write in Apple IOS AND Ipados

CWE-787 — Out-of-bounds Write20 documents12 sources
Severity
10.0CRITICALNVD
EPSS
0.1%
top 75.10%
CISA KEV
KEV
Added 2025-03-13
Due 2025-04-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
9
Apple IOS AND IpadosApple IpadosApple Macos+6 more
Timeline
PublishedMar 11
KEV addedMar 13
Latest updateApr 1
KEV dueApr 3
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages13 packages

▶CVEListV5apple/ipados< 17.7.6
▶NVDapple/ipados15.8 — 15.8.4+3
▶CVEListV5apple/ios_and_ipados< 15.8.4+2
▶CVEListV5apple/macos< 15.3.2
▶NVDapple/macos15.0 — 15.3.2

Also affects: Debian Linux 11.0

🔴Vulnerability Details

5
OSV
CVE-2025-24201: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions↗2025-03-11
▶
CVEList
CVE-2025-24201: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions↗2025-03-11
▶
GHSA
GHSA-2j99-5q75-3f57: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions↗2025-03-11
▶
OSV
CVE-2025-24201: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions↗2025-03-11
▶
VulnCheck
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability↗2025
▶

📋Vendor Advisories

13
Apple
CVE-2025-24201: watchOS 11.4↗2025-04-01
▶
Ubuntu
WebKitGTK vulnerabilities↗2025-03-31
▶
Apple
CVE-2025-24201: iOS 15.8.4 and iPadOS 15.8.4↗2025-03-31
▶
Apple
CVE-2025-24201: iPadOS 17.7.6↗2025-03-31
▶
Apple
CVE-2025-24201: iOS 16.7.11 and iPadOS 16.7.11↗2025-03-31
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Apple fixes WebKit zero-day exploited in &lsquo;extremely sophisticated&rsquo; attacks↗2025-03-11
▶
CVE-2025-24201 — Out-of-bounds Write in Apple | cvebase