CVE-2025-24224
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description
The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to cause unexpected system termination.
Analysis
Remote denial-of-service in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows unauthenticated network attackers to trigger unexpected system termination via improved checks bypass. Affects multiple OS versions prior to their respective May 2025 updates (iOS/iPadOS 18.5/17.7.9, macOS Sequoia 15.5/Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5). No public exploit identified at time of analysis. EPSS probability of 0.27% (51st percentile) suggests relatively low observed exploitation activity, though the network-accessible attack vector and lack of authentication requirements (CVSS AV:N/PR:N) create broad exposure surface across Apple's ecosystem.
Technical Context
This vulnerability stems from CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating insufficient input validation or error handling in a network-accessible component shared across Apple's operating system platforms. The broad CPE coverage spanning iOS, iPadOS, macOS (multiple versions), tvOS, visionOS, and watchOS suggests the affected code exists in a core networking or system library common to Apple's operating system architecture. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) in the CVSS vector indicate the flaw can be triggered through standard network protocols without special conditions. Apple's fix description of 'improved checks' confirms the root cause was inadequate validation of network input, allowing malformed or unexpected data to cause system-level instability rather than graceful error handling.
Affected Products
Apple iOS versions prior to 18.5, iPadOS versions prior to 18.5 and 17.7.9, macOS Sequoia versions prior to 15.5, macOS Ventura versions prior to 13.7.7, tvOS versions prior to 18.5, visionOS versions prior to 2.5, and watchOS versions prior to 11.5 are affected (CPE identifiers cpe:2.3:o:apple:iphone_os:*, cpe:2.3:o:apple:ipados:*, cpe:2.3:o:apple:macos:*, cpe:2.3:o:apple:tvos:*, cpe:2.3:o:apple:visionos:*, cpe:2.3:o:apple:watchos:*). The vulnerability spans Apple's entire operating system ecosystem, affecting consumer mobile devices, desktop/server systems, streaming devices, mixed-reality headsets, and wearables. Vendor advisories are available at Apple Support knowledge base articles HT122404, HT122716, HT122720, HT122721, HT122722, HT124148, and HT124151.
Remediation
Apply vendor-released patches immediately through Apple's standard update mechanisms. For iOS and iPadOS devices, upgrade to iOS 18.5/iPadOS 18.5 or iPadOS 17.7.9 for devices on the 17.x branch via Settings > General > Software Update. For macOS systems, upgrade to macOS Sequoia 15.5 or macOS Ventura 13.7.7 via System Settings > General > Software Update. Update tvOS devices to 18.5, visionOS devices to 2.5, and watchOS devices to 11.5 through their respective update interfaces. Consult official Apple security advisories at https://support.apple.com/en-us/122404, https://support.apple.com/en-us/122716, https://support.apple.com/en-us/122720, https://support.apple.com/en-us/122721, https://support.apple.com/en-us/122722, https://support.apple.com/en-us/124148, and https://support.apple.com/en-us/124151 for platform-specific guidance. No workarounds are available; patching is the only effective mitigation. Network-level filtering cannot reliably prevent exploitation given the low attack complexity and likely targeting of standard protocols. Enterprise administrators should prioritize updates for externally-facing iOS/iPadOS devices and macOS servers, then proceed with internal fleet updates through mobile device management (MDM) platforms.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today