CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
Published Mar 5, 2025
·Updated
Accessibility. An authorization issue was addressed with improved state management.
Credit
Apple, Apple Security Engineering, Architecture (SEAR), Bill Marczak(The Citizen Lab at The University of Toronto), Jimmy, Jax Reissner, Mickey Jin@@patch1t, @@RenwaX23, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), an anonymous researcher, Andrew James Gonzalez, Richard Hyunho Im with routezero.security@@richeeta, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc, Paul Bakker(ParagonERP), Gary Kwong, rheza@@ginggilBesel, Francisco Alonso@@revskills, Lukas Bernhard, Tashita Software Security, Xiangwei Zhang(Tencent Security YUNDING LAB), linjy(HKUS3Lab), chluo(WHUSecLab), Brendon Tiszka(Google Project Zero), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), CVE-2025-24085, Uri Katz (Oligo Security), CVE-2024-9681, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), CVE-2025-27113, CVE-2024-56171, Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, Kirin@@Pwnrin, Lehan Dilusha@@zafer, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), pattern-f@@pattern_F_, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Andr.Ess, Wang Yu(Cyberserval), CVE-2024-48958, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Syarif Muhammad Sajjad, Halle Winkler, Politepix theoffcuts.org, Bohdan Stasiuk@@bohdan_stasiuk, Ron Masas(BREAKPOINT), Dominik Rath, Martin Kreichgauer(Google Chrome)
Affected Software
34 affected componentsFixes available
Apple visionOS<2.3.2
2.3.2
Apple macOS Sequoia<15.3.2
15.3.2
Microsoft Edge<134.0.3124.62
Apple Multiple Products
Google Chrome<134.0.6998.88
134.0.6998.88
Apple Safari<18.3.1
18.3.1
Microsoft Edge (Chromium-based)
Apple visionOS<2.3.2
Apple iOS<17.2
Apple iPadOS<17.2
Apple macOS Sequoia<15.3.2
Apple iOS<18.3.2
18.3.2
Apple iPadOS<18.3.2
18.3.2
debian/chromium<=134.0.6998.35-1~deb12u1
135.0.7049.52-1~deb12u1
debian/webkit2gtk<=2.44.2-1~deb11u1, <=2.46.6-1~deb11u1, <=2.46.6-1~deb12u1
2.48.0-1~deb12u12.48.0-12.48.1-1
debian/wpewebkit<=2.38.6-1~deb11u1, <=2.38.6-1
2.48.0-12.48.1-1
Apple iOS<15.8.4
15.8.4
Apple iPadOS<15.8.4
15.8.4
Apple iOS<16.7.11
16.7.11
Apple iPadOS<16.7.11
16.7.11
Apple iPadOS<17.7.6
17.7.6
Apple WatchOS<11.4
11.4
Apple Safari<18.3.1
Apple macOS>=15.0<15.3.2
Apple visionOS<2.3.2
Apple WatchOS<11.4
Apple iPadOS>=15.8<15.8.4
Apple iPadOS>=16.7<16.7.11
Apple iPadOS>=17.0<17.7.6
Apple iPadOS>=18.0<18.3.2
Apple iPhone OS>=15.8<15.8.4
Apple iPhone OS>=16.7<16.7.11
Apple iPhone OS>=17.0<18.3.2
Debian Debian Linux=11.0
Remediation
Information
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Event History
Mar 5, 2025
CVE Published
12:00 AM
Known Exploited
12:00 AM
Mar 11, 2025
CVE Published
via MITRE·06:07 PM
Data Sourced
via MITRE·06:07 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Mar 12, 2025
News Published
via The Register·01:24 AM
News Published
via The Register·01:29 AM
Mar 13, 2025
Data Sourced
via Red Hat·04:40 AM
DescriptionSeverityAffected Software
Mar 31, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
Apr 1, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
News Published
via BleepingComputer·01:35 PM
News Published
via BleepingComputer·01:36 PM
Apr 2, 2025
News Published
via The Register·06:13 AM
Apr 4, 2025
Data Sourced
via Ubuntu·04:13 PM
RemedyDescriptionSeverityAffected Software
Apr 16, 2025
News Published
via BleepingComputer·06:06 PM
Jul 30, 2025
News Published
via BleepingComputer·04:10 PM
Sep 16, 2025
News Published
via BleepingComputer·12:16 PM
Dec 12, 2025
News Published
via BleepingComputer·11:23 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-24201?
CVE-2025-24201 is considered a critical vulnerability due to its potential to allow unauthorized actions through an out-of-bounds write issue.
2
How do I fix CVE-2025-24201?
To mitigate CVE-2025-24201, upgrade to visionOS 2.3.2, iOS 18.3.2, iPadOS 18.3.2, or macOS Sequoia 15.3.2.
3
What software versions are affected by CVE-2025-24201?
CVE-2025-24201 affects versions of visionOS prior to 2.3.2, iOS prior to 18.3.2, iPadOS prior to 18.3.2, and macOS Sequoia prior to 15.3.2.
4
What type of attack can exploit CVE-2025-24201?
CVE-2025-24201 can be exploited through maliciously crafted web content allowing it to escape the Web Content sandbox.
5
Which Apple product requires an update to address CVE-2025-24201?
Apple products including visionOS, iOS, iPadOS, macOS Sequoia, and Safari require an update to address CVE-2025-24201.