CVE-2025-24166: Input Validation

Q: What is the status of CVE-2025-24166?

CVE-2025-24166 has been rejected or withdrawn by its CVE Numbering Authority.

Q: Which software was supposed to be affected by CVE-2025-24166?

CVE-2025-24166 was associated with several Apple products, including iPadOS, macOS Ventura, macOS Sonoma, visionOS, macOS Sequoia, watchOS, tvOS, and iOS.

Q: What does it mean if a CVE is rejected like CVE-2025-24166?

If a CVE is rejected, it means that the vulnerability was determined not to exist or is no longer considered relevant.

Q: Where can I find more information on vulnerabilities like CVE-2025-24166?

Information on other vulnerabilities can typically be found through vendor support pages and security advisories.

Q: How should I respond to the rejection of CVE-2025-24166 in my systems?

Since CVE-2025-24166 pertains to a rejected vulnerability, no immediate action is required for securing affected systems.

Published Jan 27, 2025

Updated

Accessibility. An authentication issue was addressed with improved state management.

Other sources

AirPlay. A null pointer dereference was addressed with improved input validation.

— Apple

AirPlay. A type confusion issue was addressed with improved checks.

— Apple

AirPlay. An input validation issue was addressed.

— Apple

AirPlay. The issue was addressed with improved memory handling.

— Apple

ARKit. The issue was addressed with improved checks.

— Apple

Credit

Ivan Fratric(Google Project Zero), Hichem Maloufi, Hakim Boukhadra, Anonymous(Trend Micro Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), mastersplinter, @@RenwaX23, Kirin@@Pwnrin, an anonymous researcher, Q1IQ@@q1iqF(NUS CuriOSity), P1umer@@p1umer(Imperial Global Singapore), linjy(HKUS3Lab), chluo(WHUSecLab), Johan Carlsson (joaxcar), DongJun Kim@@smlijun, JongSeong Kim in Enki WhiteHat@@nevul37, D4m0n, Joseph Ravichandran@@0xjprx(MIT CSAIL), pattern-f@@pattern_F_, Michael (Biscuit) Thomas @social.lol)@@biscuit, Gary Kwong, Uri Katz (Oligo Security), Minghao Lin@@Y1nKoc(Zhejiang University), babywu(Zhejiang University), (Zhejiang University), Xingwei Lin(Zhejiang University), Google Threat Analysis Group, Desmond(Trend Micro Zero Day Initiative), Pwn2car & Rotiple(HyeongSeok Jang)(Trend Micro Zero Day Initiative), Song Hyun Bae@@bshyuunn, Lee Dong Ha (Who4mI), Pwn2car & Rotiple (HyeongSeok Jang)(Trend Micro Zero Day Initiative), CVE-2025-24085, Wang Yu(Cyberserval), Denis Tokarev@@illusionofcha0s, Zikan Wang@@Lakr233, Mateusz Krzywicki@@krzywix, Guilherme Rambo(Best Buddy Apps), Mickey Jin@@patch1t, Jason Gendron@@gendron_jason, 이준성 (Junsung Lee), Abhay Kailasia@@abhay_kailasia(C)

Affected Software

11 affected componentsFixes available

Apple iPadOS

Apple macOS Ventura

Apple macOS Sonoma

Apple visionOS

Apple macOS Sequoia

Apple WatchOS

Apple tvOS

Apple iOS

Apple iPadOS<17.7.4

17.7.4

Apple iOS<18.3

18.3

Apple iPadOS<18.3

18.3

Event History

Jan 27, 2025

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

CVE Published

via MITRE·09:46 PM

Rejected

via MITRE·09:46 PM

Data Sourced

via NVD·10:15 PM

Description

Jan 28, 2025

Rejected

via MITRE·09:35 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the status of CVE-2025-24166?

CVE-2025-24166 has been rejected or withdrawn by its CVE Numbering Authority.

Which software was supposed to be affected by CVE-2025-24166?

CVE-2025-24166 was associated with several Apple products, including iPadOS, macOS Ventura, macOS Sonoma, visionOS, macOS Sequoia, watchOS, tvOS, and iOS.

What does it mean if a CVE is rejected like CVE-2025-24166?

If a CVE is rejected, it means that the vulnerability was determined not to exist or is no longer considered relevant.

Where can I find more information on vulnerabilities like CVE-2025-24166?

Information on other vulnerabilities can typically be found through vendor support pages and security advisories.

How should I respond to the rejection of CVE-2025-24166 in my systems?

Since CVE-2025-24166 pertains to a rejected vulnerability, no immediate action is required for securing affected systems.

CVE-2025-24166: Input Validation

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the status of CVE-2025-24166?

Which software was supposed to be affected by CVE-2025-24166?

What does it mean if a CVE is rejected like CVE-2025-24166?

Where can I find more information on vulnerabilities like CVE-2025-24166?

How should I respond to the rejection of CVE-2025-24166 in my systems?

Company

Resources

Contact