Log in Start free

Actively exploited · Published Mar 11, 2025 · Assigned by apple

CVE-2025-24201

Critical 10.0 Exploited

In plain English

A critical-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on March 13, 2025). The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)3.8%top 9.8% of all CVEs
Exploited in the wildYesCISA KEV since Mar 13, 2025
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Apr 3, 2025.

Official description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.46.6-2.el8_10ALSA-2025:2863
AlmaLinux:9webkit2gtk32.46.6-2.el9_5ALSA-2025:2864
AlmaLinux:8webkit2gtk3-devel2.46.6-2.el8_10ALSA-2025:2863
AlmaLinux:9webkit2gtk3-devel2.46.6-2.el9_5ALSA-2025:2864
AlmaLinux:8webkit2gtk3-jsc2.46.6-2.el8_10ALSA-2025:2863
AlmaLinux:9webkit2gtk3-jsc2.46.6-2.el9_5ALSA-2025:2864
AlmaLinux:8webkit2gtk3-jsc-devel2.46.6-2.el8_10ALSA-2025:2863
AlmaLinux:9webkit2gtk3-jsc-devel2.46.6-2.el9_5ALSA-2025:2864
Alpine:v3.21qt5-qtwebengine5.15.17-r7ALPINE-CVE-2025-24201
Alpine:v3.22qt5-qtwebengine5.15.17-r10ALPINE-CVE-2025-24201
Alpine:v3.23qt5-qtwebengine5.15.17-r10ALPINE-CVE-2025-24201
Alpine:v3.22qt6-qtwebengine6.8.2-r3ALPINE-CVE-2025-24201
Alpine:v3.23qt6-qtwebengine6.8.2-r3ALPINE-CVE-2025-24201
Alpine:v3.24qt6-qtwebengine6.8.2-r3ALPINE-CVE-2025-24201
Debian:12chromium134.0.6998.88-1~deb12u1DSA-5877-1
Debian:12chromium134.0.6998.88-1~deb12u1DEBIAN-CVE-2025-24201
Debian:12webkit2gtk2.48.0-1~deb12u1DSA-5885-1
Debian:12webkit2gtk2.48.0-1~deb12u1DEBIAN-CVE-2025-24201
Debian:13webkit2gtk2.48.0-1DEBIAN-CVE-2025-24201
Debian:14webkit2gtk2.48.0-1DEBIAN-CVE-2025-24201
Debian:12wpewebkitno fix listedDEBIAN-CVE-2025-24201
Debian:13wpewebkit2.48.0-1DEBIAN-CVE-2025-24201
Debian:14wpewebkit2.48.0-1DEBIAN-CVE-2025-24201
Rocky Linux:8webkit2gtk30:2.46.6-2.el8_10RLSA-2025:2863
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-24201
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-24201
Ubuntu:22.04:LTSwebkit2gtk2.48.0-0ubuntu0.22.04.1USN-7395-1
Ubuntu:22.04:LTSwebkit2gtk2.48.0-0ubuntu0.22.04.1UBUNTU-CVE-2025-24201
Ubuntu:24.04:LTSwebkit2gtk2.48.0-0ubuntu0.24.04.1UBUNTU-CVE-2025-24201
Ubuntu:24.04:LTSwebkit2gtk2.48.0-0ubuntu0.24.04.1USN-7395-1
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2025-24201

Affected products (as reported)

VendorProductVersions
Apple Safari 0 – before 18.3.1
Apple iOS and iPadOS 0 – before 15.8.40 – before 16.7.110 – before 18.3.2
Apple iPadOS 0 – before 17.7.6
Apple macOS 0 – before 15.3.2
Apple visionOS 0 – before 2.3.2
Apple watchOS 0 – before 11.4

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References