iOS CVE-2025-24224
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to cause unexpected system termination.
AnalysisAI
Remote denial-of-service in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows unauthenticated network attackers to trigger unexpected system termination via improved checks bypass. Affects multiple OS versions prior to their respective May 2025 updates (iOS/iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5). No public exploit identified at time of analysis. EPSS probability of 0.27% (51st percentile) suggests relatively low observed exploitation activity, though the network-accessible attack vector and lack of authentication requirements (CVSS AV:N/PR:N) create broad exposure surface across Apple's ecosystem.
Technical ContextAI
This vulnerability stems from CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating insufficient input validation or error handling in a network-accessible component shared across Apple's operating system platforms. The broad CPE coverage spanning iOS, iPadOS, macOS (multiple versions), tvOS, visionOS, and watchOS suggests the affected code exists in a core networking or system library common to Apple's operating system architecture. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) in the CVSS vector indicate the flaw can be triggered through standard network protocols without special conditions. Apple's fix description of 'improved checks' confirms the root cause was inadequate validation of network input, allowing malformed or unexpected data to cause system-level instability rather than graceful error handling.
RemediationAI
Apply vendor-released patches immediately through Apple's standard update mechanisms. For iOS and iPadOS devices, upgrade to iOS 18.5/iPadOS 18.5 or iPadOS 17.7.9 for devices on the 17.x branch via Settings > General > Software Update. For macOS systems, upgrade to macOS Sequoia 15.5 or macOS Ventura 13.7.7 via System Settings > General > Software Update. Update tvOS devices to 18.5, visionOS devices to 2.5, and watchOS devices to 11.5 through their respective update interfaces. Consult official Apple security advisories at https://support.apple.com/en-us/122404, https://support.apple.com/en-us/122716, https://support.apple.com/en-us/122720, https://support.apple.com/en-us/122721, https://support.apple.com/en-us/122722, https://support.apple.com/en-us/124148, and https://support.apple.com/en-us/124151 for platform-specific guidance. No workarounds are available; patching is the only effective mitigation. Network-level filtering cannot reliably prevent exploitation given the low attack complexity and likely targeting of standard protocols. Enterprise administrators should prioritize updates for externally-facing iOS/iPadOS devices and macOS servers, then proceed with internal fleet updates through mobile device management (MDM) platforms.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Share
External POC / Exploit Code
Leaving vuln.today