CVE-2025-24180: Input Validation
Published Mar 31, 2025
·Updated
Accessibility. A logging issue was addressed with improved data redaction.
Credit
Uri Katz (Oligo Security), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Dominik Rath, Martin Kreichgauer(Google Chrome), Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), CVE-2024-9681, Andr.Ess, Kirin@@Pwnrin, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Wang Yu(Cyberserval), Michael (Biscuit) Thomas - @social.lol@@biscuit, CVE-2024-48958, an anonymous researcher, CVE-2025-27113, CVE-2024-56171, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Minghao Lin@@Y1nKoc, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Jimmy, Mickey Jin@@patch1t, Jaydev Ahire, @@RenwaX23, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Andrew James Gonzalez, Alexander Heinrich@@Sn0wfreeze, SEEMOO, TU Darmstadt & Mathy Vanhoef@@vanhoefm, Jeroen Robben@@RobbenJeroen, DistriNet, KU Leuven, Vsevolod Kokorin (Slonser)(Solidlab), Gary Kwong, Paul Bakker(ParagonERP), rheza@@ginggilBesel, Lehan Dilusha@@zafer, pattern-f@@pattern_F_, Gergely Kalman@@gergely_kalman, mzzzz__, Muhammad Zaid Ghifari (Mr.ZheeV), Kalimantan Utara, Florian Draschbacher, Jax Reissner, Dalibor Milanovic, Syarif Muhammad Sajjad, Wojciech Regula(SecuRing), Abhay Kailasia@@abhay_kailasia(C), Chi Yuan Chang(ZUSO ART), taikosoup, Bohdan Stasiuk@@bohdan_stasiuk, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Richard Hyunho Im with routezero.security@@richeeta, Francisco Alonso@@revskills, Ron Masas(BREAKPOINT), Zhongcheng Li(IES Red Team of ByteDance), Ian Mckay@@iann0036, Csaba Fitzl@@theevilbit(Kandji), Nolan Astrein(Kandji), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Pietro Francesco Tirenna(Shielder), Davide Silvetti(Shielder), Abdel Adim Oisfi(Shielder), luckyu@@uuulucky, Rodolphe BRUNETTI@@eisw0lf, Manuel Fernandez (Stackhopper Security), ABC Research s.r.o., Murray Mike, Dayton Pidhirney(Atredis Partners), Lyutoon, YenKoc, Ye Zhang@@VAR10CK(Baidu Security), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Ian Beer(Google Project Zero), Joseph Ravichandran@@0xjprx(MIT CSAIL), Kenneth Chew, Paweł Płatek (Trail(Bits), Diamant Osmani & Valdrin Haliti [Kosovë], dbpeppe, Solitechworld, Pwn2car, Mickey Jin@@patch1t(Kandji), (Kandji), Pedro Tôrres@@t0rr3sp3dr0, Noah Gregory (wts.dev), CVE-2023-27043, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Yiğit Can YILMAZ@@yilmazcanyigit, Arsenii Kostromin (0x3c3e), Dolf Hoegaerts, Michiel Devliegere, K宝@@Pwnrin, Tong Liu@@Lyutoon_, 风(binary_fmyy), F00L, zbleet(QI), Cristian Dinca(Computer Science), Romania, 风沐云烟 (binary_fmyy), Kirin, FlowerCode, Zhongquan Li@@Guluisacat, Pedro José Pereira Vieito / pvieito.com)@@pvieito, PixiePoint Security, Andreas Hegenberg (folivora.AI GmbH), Apple
Affected Software
11 affected componentsFixes available
Apple Safari<18.4
Apple iPadOS<18.4
Apple iPhone OS<18.4
Apple macOS>=15.0<15.4
Apple visionOS<2.3
Apple visionOS<2.4
2.4
Apple iOS<18.4
18.4
Apple iPadOS<18.4
18.4
Apple macOS Sequoia<15.4
15.4
Apple Safari<18.4
18.4
Apple WatchOS<11.4
11.4
Event History
Mar 31, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
CVE Published
via MITRE·10:23 PM
Data Sourced
via MITRE·10:23 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Apr 1, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
News Published
via BleepingComputer·01:35 PM
News Published
via BleepingComputer·01:36 PM
Apr 5, 2025
Known Exploited
01:36 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-24180?
The severity of CVE-2025-24180 is classified as a high-level vulnerability due to its impact on security and accessibility.
2
How do I fix CVE-2025-24180?
To mitigate CVE-2025-24180, users should upgrade to the latest versions of affected Apple software, specifically version 18.4 or later for iOS and iPadOS.
3
What affected software is impacted by CVE-2025-24180?
CVE-2025-24180 impacts various Apple products, including Safari, iOS, iPadOS, macOS, and visionOS, specifically versions prior to the latest releases.
4
What kind of issue is addressed by CVE-2025-24180?
CVE-2025-24180 addresses issues related to accessibility and permissions, improving data redaction and access restrictions throughout the software.
5
Is there a specific version of software to update for CVE-2025-24180?
Yes, to resolve CVE-2025-24180, users should update to the respective software versions: iOS 18.4, iPadOS 18.4, and Safari 18.4.