What is the CVSS score of CVE-2025-24224?

CVE-2025-24224 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of iOS are affected by CVE-2025-24224?

CVE-2025-24224 is a network-accessible denial-of-service vulnerability affecting all major Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) that allows unauthenticated attackers…

How to fix or mitigate CVE-2025-24224?

Within 24 hours: inventory all Apple devices by OS version and document current update status; identify critical systems running affected versions (iOS/iPadOS <18.5/17.7.9, macOS Sequoia <15.5/Ventura <13.7.7, tvOS <18.5, visionOS <2.5, watchOS <11.5). Within 7 days: implement network segmentation to limit untrusted network access to Apple devices where feasible; document business justification for any devices unable to update. Within 30 days: deploy May 2025 security updates (iOS 18.5, iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5) immediately upon release using MDM or manual channels.

iOS CVE-2025-24224

HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2025-07-30 product-security@apple.com

Apple iOS Denial Of Service Ipados Iphone Os Tvos Visionos Watchos

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to cause unexpected system termination.

AnalysisAI

Remote denial-of-service in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows unauthenticated network attackers to trigger unexpected system termination via improved checks bypass. Affects multiple OS versions prior to their respective May 2025 updates (iOS/iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5). No public exploit identified at time of analysis. EPSS probability of 0.27% (51st percentile) suggests relatively low observed exploitation activity, though the network-accessible attack vector and lack of authentication requirements (CVSS AV:N/PR:N) create broad exposure surface across Apple's ecosystem.

Technical ContextAI

This vulnerability stems from CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating insufficient input validation or error handling in a network-accessible component shared across Apple's operating system platforms. The broad CPE coverage spanning iOS, iPadOS, macOS (multiple versions), tvOS, visionOS, and watchOS suggests the affected code exists in a core networking or system library common to Apple's operating system architecture. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) in the CVSS vector indicate the flaw can be triggered through standard network protocols without special conditions. Apple's fix description of 'improved checks' confirms the root cause was inadequate validation of network input, allowing malformed or unexpected data to cause system-level instability rather than graceful error handling.

RemediationAI

Apply vendor-released patches immediately through Apple's standard update mechanisms. For iOS and iPadOS devices, upgrade to iOS 18.5/iPadOS 18.5 or iPadOS 17.7.9 for devices on the 17.x branch via Settings > General > Software Update. For macOS systems, upgrade to macOS Sequoia 15.5 or macOS Ventura 13.7.7 via System Settings > General > Software Update. Update tvOS devices to 18.5, visionOS devices to 2.5, and watchOS devices to 11.5 through their respective update interfaces. Consult official Apple security advisories at https://support.apple.com/en-us/122404, https://support.apple.com/en-us/122716, https://support.apple.com/en-us/122720, https://support.apple.com/en-us/122721, https://support.apple.com/en-us/122722, https://support.apple.com/en-us/124148, and https://support.apple.com/en-us/124151 for platform-specific guidance. No workarounds are available; patching is the only effective mitigation. Network-level filtering cannot reliably prevent exploitation given the low attack complexity and likely targeting of standard protocols. Enterprise administrators should prioritize updates for externally-facing iOS/iPadOS devices and macOS servers, then proceed with internal fleet updates through mobile device management (MDM) platforms.