CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Published Mar 5, 2025
·
Updated

Accessibility. An authorization issue was addressed with improved state management.

Other sources

Accounts. This issue was addressed with improved data access restriction.

— Apple

AirDrop. A permissions issue was addressed with additional restrictions.

— Apple

AirPlay. A null pointer dereference was addressed with improved input validation.

— Apple

AirPlay. A type confusion issue was addressed with improved checks.

— Apple

AirPlay. A use-after-free issue was addressed with improved memory management.

— Apple

Credit

Apple, Apple Security Engineering, Architecture (SEAR), Bill Marczak(The Citizen Lab at The University of Toronto), Jimmy, Jax Reissner, Mickey Jin@@patch1t, @@RenwaX23, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), an anonymous researcher, Andrew James Gonzalez, Richard Hyunho Im with routezero.security@@richeeta, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc, Paul Bakker(ParagonERP), Gary Kwong, rheza@@ginggilBesel, Francisco Alonso@@revskills, Lukas Bernhard, Tashita Software Security, Xiangwei Zhang(Tencent Security YUNDING LAB), linjy(HKUS3Lab), chluo(WHUSecLab), Brendon Tiszka(Google Project Zero), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), CVE-2025-24085, Uri Katz (Oligo Security), CVE-2024-9681, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), CVE-2025-27113, CVE-2024-56171, Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, Kirin@@Pwnrin, Lehan Dilusha@@zafer, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), pattern-f@@pattern_F_, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Andr.Ess, Wang Yu(Cyberserval), CVE-2024-48958, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Syarif Muhammad Sajjad, Halle Winkler, Politepix theoffcuts.org, Bohdan Stasiuk@@bohdan_stasiuk, Ron Masas(BREAKPOINT), Dominik Rath, Martin Kreichgauer(Google Chrome)

Affected Software

34 affected componentsFixes available
Apple visionOS<2.3.2
2.3.2
Apple macOS Sequoia<15.3.2
15.3.2
Microsoft Edge<134.0.3124.62
Apple Multiple Products
Google Chrome<134.0.6998.88
134.0.6998.88
Apple Safari<18.3.1
18.3.1
Microsoft Edge (Chromium-based)
Patch available
Apple visionOS<2.3.2
Apple iOS<17.2
Apple iPadOS<17.2
Apple macOS Sequoia<15.3.2
Apple iOS<18.3.2
18.3.2
Apple iPadOS<18.3.2
18.3.2
debian/chromium<=134.0.6998.35-1~deb12u1
135.0.7049.52-1~deb12u1
debian/webkit2gtk<=2.44.2-1~deb11u1, <=2.46.6-1~deb11u1, <=2.46.6-1~deb12u1
2.48.0-1~deb12u12.48.0-12.48.1-1
debian/wpewebkit<=2.38.6-1~deb11u1, <=2.38.6-1
2.48.0-12.48.1-1
Apple iOS<15.8.4
15.8.4
Apple iPadOS<15.8.4
15.8.4
Apple iOS<16.7.11
16.7.11
Apple iPadOS<16.7.11
16.7.11
Apple iPadOS<17.7.6
17.7.6
Apple WatchOS<11.4
11.4
Apple Safari<18.3.1
Apple macOS>=15.0<15.3.2
Apple visionOS<2.3.2
Apple WatchOS<11.4
Apple iPadOS>=15.8<15.8.4
Apple iPadOS>=16.7<16.7.11
Apple iPadOS>=17.0<17.7.6
Apple iPadOS>=18.0<18.3.2
Apple iPhone OS>=15.8<15.8.4
Apple iPhone OS>=16.7<16.7.11
Apple iPhone OS>=17.0<18.3.2
Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade visionOS to a version that resolves this vulnerability.

    Fixed in 2.3.2
  2. Upgrade

    Upgrade macOS to a version that resolves this vulnerability.

    Fixed in 15.3.2
  3. Upgrade

    Upgrade Google Chrome to a version that resolves this vulnerability.

    Fixed in 134.0.6998.88
  4. Upgrade

    Upgrade Safari to a version that resolves this vulnerability.

    Fixed in 18.3.1
  5. Upgrade

    Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.

    Fixed in 18.3.2
  6. Upgrade

    Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.

    Fixed in 18.3.2
  7. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 135.0.7049.52-1~deb12u1
  8. Upgrade

    Upgrade debian/webkit2gtk to a version that resolves this vulnerability.

    Fixed in 2.48.0-1~deb12u1Fixed in 2.48.0-1Fixed in 2.48.1-1
  9. Upgrade

    Upgrade debian/wpewebkit to a version that resolves this vulnerability.

    Fixed in 2.48.0-1Fixed in 2.48.1-1
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.8.4
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 16.7.11
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.7.6
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 11.4
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in Safari 18.3.1
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iOS 15.8.4
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iPadOS 15.8.4
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iOS 16.7.11
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iPadOS 16.7.11
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iOS 18.3.2
  20. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iPadOS 18.3.2
  21. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in iPadOS 17.7.6
  22. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.3.2
  23. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.3.2
  24. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch CVE-2025-24201
  25. Compensating control

    If mitigations are unavailable, discontinue use of the affected Apple product. (Mitigations per vendor instructions; follow applicable BOD 22-01 guidance for cloud services.)

Event History

Mar 5, 2025
CVE Published
12:00 AM
Known Exploited
12:00 AM
Mar 11, 2025
CVE Published
via MITRE·06:07 PM
Data Sourced
via MITRE·06:07 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Mar 12, 2025
News Published
via The Register·01:24 AM
News Published
via The Register·01:29 AM
Mar 13, 2025
Data Sourced
via Red Hat·04:40 AM
DescriptionSeverityAffected Software
Mar 31, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
Apr 1, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
News Published
via BleepingComputer·01:35 PM
News Published
via BleepingComputer·01:36 PM
Apr 2, 2025
News Published
via The Register·06:13 AM
Apr 4, 2025
Data Sourced
via Ubuntu·04:13 PM
RemedyDescriptionSeverityAffected Software
Apr 16, 2025
News Published
via BleepingComputer·06:06 PM
Jul 30, 2025
News Published
via BleepingComputer·04:10 PM
Sep 16, 2025
News Published
via BleepingComputer·12:16 PM
Dec 12, 2025
News Published
via BleepingComputer·11:23 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-24201?

CVE-2025-24201 is considered a critical vulnerability due to its potential to allow unauthorized actions through an out-of-bounds write issue.

2

How do I fix CVE-2025-24201?

To mitigate CVE-2025-24201, upgrade to visionOS 2.3.2, iOS 18.3.2, iPadOS 18.3.2, or macOS Sequoia 15.3.2.

3

What software versions are affected by CVE-2025-24201?

CVE-2025-24201 affects versions of visionOS prior to 2.3.2, iOS prior to 18.3.2, iPadOS prior to 18.3.2, and macOS Sequoia prior to 15.3.2.

4

What type of attack can exploit CVE-2025-24201?

CVE-2025-24201 can be exploited through maliciously crafted web content allowing it to escape the Web Content sandbox.

5

Which Apple product requires an update to address CVE-2025-24201?

Apple products including visionOS, iOS, iPadOS, macOS Sequoia, and Safari require an update to address CVE-2025-24201.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203