CVE-2025-24139: Input Validation
Published Jan 27, 2025
·Updated
AccountPolicy. This issue was addressed by removing the vulnerable code.
Other sources
AirPlay. A null pointer dereference was addressed with improved input validation.
— Apple
AirPlay. A type confusion issue was addressed with improved checks.
— Apple
AirPlay. A use-after-free issue was addressed with improved memory management.
— Apple
AirPlay. An access issue was addressed with improved access restrictions.
— Apple
AirPlay. An authentication issue was addressed with improved state management.
— Apple
Credit
Uri Katz (Oligo Security), Mickey Jin@@patch1t, D4m0n, Kirin@@Pwnrin, Bohdan Stasiuk@@Bohdan_Stasiuk, Minghao Lin@@Y1nKoc(Zhejiang University), babywu(Zhejiang University), (Zhejiang University), Xingwei Lin(Zhejiang University), Wang Yu(Cyberserval), Google Threat Analysis Group, Desmond(Trend Micro Zero Day Initiative), Pwn2car & Rotiple (HyeongSeok Jang)(Trend Micro Zero Day Initiative), CVE-2025-24085, Song Hyun Bae@@bshyuunn, Lee Dong Ha (Who4mI), Matej Moravec@@MacejkoMoravec, Arsenii Kostromin (0x3c3e), Joshua Jones, DongJun Kim@@smlijun, JongSeong Kim in Enki WhiteHat@@nevul37, Mateusz Krzywicki@@krzywix, Joseph Ravichandran@@0xjprx(MIT CSAIL), an anonymous researcher, pattern-f@@pattern_F_, Michael (Biscuit) Thomas @social.lol)@@biscuit, Ivan Fratric(Google Project Zero), 风(binary_fmyy), Minghao Lin@(Y1nKoc), Pedro Tôrres@@t0rr3sp3dr0, Josh Parnham@@joshparnham, 神罚@@Pwnrin, @@RenwaX23, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Zhongquan Li@@Guluisacat, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Junsung Lee, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Yann GASCUEL(Alter Solutions), Adam M., Q1IQ@@q1iqF(NUS CuriOSity), P1umer@@p1umer(Imperial Global Singapore), linjy(HKUS3Lab), chluo(WHUSecLab), Johan Carlsson (joaxcar), PixiePoint Security, Pwn2car & Rotiple(HyeongSeok Jang)(Trend Micro Zero Day Initiative), Minghao Lin@@Y1nKoc, Anonymous(Trend Micro Zero Day Initiative), Yiğit Can YILMAZ@@yilmazcanyigit, Eric Dorphy(Twin Cities App Dev LLC), jioundai(360 Vulnerability Research Institute), chen fengjiao(HBC), CertiK SkyFall Team, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Wojciech Regula(SecuRing), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Bohdan Stasiuk@@bohdan_stasiuk, Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Stephan Casas, Csaba Fitzl@@theevilbit(Kandji), Gergely Kalman@@gergely_kalman, CVE-2024-9681, Pietro Francesco Tirenna(Shielder), Davide Silvetti(Shielder), Abdel Adim Oisfi(Shielder), Manuel Fernandez (Stackhopper Security), LFY@@secsys(Fudan University), Murray Mike(Trend Micro Zero Day Initiative), ABC Research s.r.o., Dave G.(Supernetworks), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), Kenneth Chew, Paweł Płatek (Trail(Bits), CVE-2025-27113, CVE-2024-56171, 风沐云烟@@binary_fmyy(Supernetworks), Minghao Lin@@Y1nKoc(Supernetworks), Alex Radocea(Supernetworks), Diamant Osmani & Valdrin Haliti [Kosovë], dbpeppe, Solitechworld, Pwn2car, Mickey Jin@@patch1t(Kandji), (Kandji), Noah Gregory (wts.dev), Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Dolf Hoegaerts, Michiel Devliegere, Andrew James Gonzalez, Junsung <3(Trend Micro Zero Day Initiative), Richard Hyunho Im with routezero.security@@richeeta, Dave G., zbleet(QI), Csaba Fitzl@@theevilbit(OffSec), 风沐云烟 (binary_fmyy)(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc(DBAppSecurity's WeBin lab), Pedro José Pereira Vieito / pvieito.com)@@pvieito, Andreas Hegenberg (folivora.AI GmbH)
Affected Software
9 affected componentsFixes available
apple macOS Ventura
apple macOS Sequoia
apple macOS Sonoma
Apple macOS<13.7.3
Apple macOS>=14.0<14.7.3
Apple macOS>=15.0<15.3
apple macOS Ventura<13.7.3
13.7.3
apple macOS Sequoia<15.3
15.3
apple macOS Sonoma<14.7.3
14.7.3
Event History
Jan 27, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·09:45 PM
Data Sourced
via MITRE·09:45 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Mar 31, 2025
Updated
via Apple·12:00 AM
DescriptionAffected Software
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2025-24126
- CVE-2025-24129
- CVE-2025-24131
- CVE-2025-24177
- CVE-2025-24179
- CVE-2025-24137
- CVE-2025-24087
- CVE-2025-24112
- CVE-2025-24100
- CVE-2025-24109
- CVE-2025-24114
- CVE-2025-24121
- CVE-2025-24122
- CVE-2025-24127
- CVE-2025-24106
- CVE-2025-24160
- CVE-2025-24161
- CVE-2025-24163
- CVE-2025-24123
- CVE-2025-24124
- CVE-2025-24085
- CVE-2025-24184
- CVE-2025-24102
- CVE-2025-24111
- CVE-2025-24134
- CVE-2025-24140
- CVE-2025-24174
- CVE-2025-24086
- CVE-2025-24144
- CVE-2025-24118
- CVE-2025-24107
- CVE-2025-24159
- CVE-2025-24119
- CVE-2025-24094
- CVE-2025-24115
- CVE-2025-24116
- CVE-2025-24117
- CVE-2024-55549
- CVE-2025-24855
- CVE-2025-24136
- CVE-2025-24101
- CVE-2025-24096
- CVE-2025-31262
- CVE-2025-24099
- CVE-2025-24130
- CVE-2025-24169
- CVE-2025-24183
- CVE-2025-24146
- CVE-2025-24128
- CVE-2025-24113
- CVE-2025-24149
- CVE-2025-24103
- CVE-2025-24108
- CVE-2025-24185
- CVE-2025-24139
- CVE-2025-24151
- CVE-2025-24152
- CVE-2025-24153
- CVE-2025-24138
- CVE-2025-24176
- CVE-2025-24135
- CVE-2025-24145
- CVE-2025-24092
- CVE-2025-24155
- CVE-2025-24154
- CVE-2025-24189
- CVE-2025-24143
- CVE-2025-24158
- CVE-2025-24162
- CVE-2025-24150
- CVE-2025-24120
- CVE-2025-24156
- CVE-2024-44172
- CVE-2024-54497
- CVE-2025-24093
- CVE-2025-31242
- CVE-2025-31248
- CVE-2025-43374
- CVE-2024-54509
- CVE-2024-44243
- CVE-2025-24234
- CVE-2025-24270
- CVE-2025-24271
- CVE-2025-24251
- CVE-2025-31197
- CVE-2025-24252
- CVE-2025-30445
- CVE-2025-24206
- CVE-2025-24276
- CVE-2024-40864
- CVE-2025-24272
- CVE-2025-24231
- CVE-2025-24233
- CVE-2025-30443
- CVE-2025-43465
- CVE-2025-43205
- CVE-2025-24243
- CVE-2025-24244
- CVE-2025-30460
- CVE-2025-24237
- CVE-2025-30429
- CVE-2025-24212
- CVE-2025-24215
- CVE-2025-24230
- CVE-2025-24190
- CVE-2025-24211
- CVE-2025-31191
- CVE-2025-24170
- CVE-2025-24277
- CVE-2024-9681
- CVE-2025-31189
- CVE-2025-24255
- CVE-2025-24267
- CVE-2025-30456
- CVE-2025-31187
- CVE-2025-30462
- CVE-2025-24199
- CVE-2025-30447
- CVE-2025-30431
- CVE-2025-24256
- CVE-2025-24273
- CVE-2025-30464
- CVE-2025-24210
- CVE-2025-24249
- CVE-2025-24229
- CVE-2025-24235
- CVE-2025-30432
- CVE-2025-24203
- CVE-2025-24148
- CVE-2025-24195
- CVE-2025-27113
- CVE-2024-56171
- CVE-2025-24178
- CVE-2025-31182
- CVE-2025-24238
- CVE-2025-31264
- CVE-2025-24172
- CVE-2025-30450
- CVE-2025-30470
- CVE-2025-24232
- CVE-2025-24246
- CVE-2025-24261
- CVE-2025-24164
- CVE-2025-30446
- CVE-2025-24259
- CVE-2025-30424
- CVE-2025-24173
- CVE-2025-30452
- CVE-2025-24181
- CVE-2025-30471
- CVE-2025-24250
- CVE-2025-30438
- CVE-2025-31194
- CVE-2025-30465
- CVE-2025-30433
- CVE-2025-24198
- CVE-2025-24205
- CVE-2025-30444
- CVE-2025-24228
- CVE-2025-24165
- CVE-2025-24260
- CVE-2025-24254
- CVE-2024-54533
- CVE-2025-24207
- CVE-2025-31261
- CVE-2025-24253
- CVE-2025-30449
- CVE-2025-31188
- CVE-2025-24240
- CVE-2025-24278
- CVE-2025-30457
- CVE-2025-31195
- CVE-2025-24279
- CVE-2025-24247
- CVE-2025-24241
- CVE-2025-24266
- CVE-2025-24265
- CVE-2025-24157
- CVE-2025-31198
Frequently Asked Questions
1
What is the severity of CVE-2025-24139?
CVE-2025-24139 has a high severity rating due to potential impact from null pointer dereference and type confusion issues.
2
How do I fix CVE-2025-24139?
To fix CVE-2025-24139, update to the latest versions of macOS Ventura 13.7.3, macOS Sequoia 15.3, or macOS Sonoma 14.7.3.
3
Which Apple products are affected by CVE-2025-24139?
CVE-2025-24139 affects Apple macOS versions including Ventura, Sequoia, and Sonoma.
4
What issues does CVE-2025-24139 address?
CVE-2025-24139 addresses a null pointer dereference, type confusion, and input validation issues in AirPlay.
5
How serious is the risk of not addressing CVE-2025-24139?
Failing to address CVE-2025-24139 could lead to application crashes or security vulnerabilities in affected Apple devices.