CVE-2025-24251: Input Validation
Published Mar 31, 2025
·Updated
Accessibility. A logging issue was addressed with improved data redaction.
Credit
Uri Katz (Oligo Security), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Dominik Rath, Martin Kreichgauer(Google Chrome), Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), CVE-2024-9681, Andr.Ess, Kirin@@Pwnrin, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Wang Yu(Cyberserval), Michael (Biscuit) Thomas - @social.lol@@biscuit, CVE-2024-48958, an anonymous researcher, CVE-2025-27113, CVE-2024-56171, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Minghao Lin@@Y1nKoc, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Jimmy, Mickey Jin@@patch1t, Jaydev Ahire, @@RenwaX23, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Andrew James Gonzalez, Alexander Heinrich@@Sn0wfreeze, SEEMOO, TU Darmstadt & Mathy Vanhoef@@vanhoefm, Jeroen Robben@@RobbenJeroen, DistriNet, KU Leuven, Vsevolod Kokorin (Slonser)(Solidlab), Gary Kwong, Paul Bakker(ParagonERP), rheza@@ginggilBesel, Lehan Dilusha@@zafer, Wojciech Regula(SecuRing), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Bohdan Stasiuk@@bohdan_stasiuk, CVE-2025-24085, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Stephan Casas, Csaba Fitzl@@theevilbit(Kandji), Gergely Kalman@@gergely_kalman, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Pietro Francesco Tirenna(Shielder), Davide Silvetti(Shielder), Abdel Adim Oisfi(Shielder), Manuel Fernandez (Stackhopper Security), Murray Mike(Trend Micro Zero Day Initiative), ABC Research s.r.o., Ian Beer(Google Project Zero), Kenneth Chew, Paweł Płatek (Trail(Bits), 风沐云烟@@binary_fmyy(Supernetworks), Minghao Lin@@Y1nKoc(Supernetworks), Diamant Osmani & Valdrin Haliti [Kosovë], dbpeppe, Solitechworld, Pwn2car, Mickey Jin@@patch1t(Kandji), (Kandji), Pedro Tôrres@@t0rr3sp3dr0, Noah Gregory (wts.dev), Arsenii Kostromin (0x3c3e), Dolf Hoegaerts, Michiel Devliegere, Junsung <3(Trend Micro Zero Day Initiative), Richard Hyunho Im with routezero.security@@richeeta, Joseph Ravichandran@@0xjprx(MIT CSAIL), zbleet(QI), Csaba Fitzl@@theevilbit(OffSec), 风沐云烟 (binary_fmyy)(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc(DBAppSecurity's WeBin lab), Zhongquan Li@@Guluisacat, PixiePoint Security, Andreas Hegenberg (folivora.AI GmbH), pattern-f@@pattern_F_, Francisco Alonso@@revskills, Ron Masas(BREAKPOINT), mzzzz__, Muhammad Zaid Ghifari (Mr.ZheeV), Kalimantan Utara, Florian Draschbacher, Jax Reissner, Dalibor Milanovic, Syarif Muhammad Sajjad, Abhay Kailasia@@abhay_kailasia(C), Chi Yuan Chang(ZUSO ART), taikosoup, Zhongcheng Li(IES Red Team of ByteDance), Ian Mckay@@iann0036, Nolan Astrein(Kandji), luckyu@@uuulucky, Rodolphe BRUNETTI@@eisw0lf, Murray Mike, Dayton Pidhirney(Atredis Partners), Lyutoon, YenKoc, Ye Zhang@@VAR10CK(Baidu Security), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), CVE-2023-27043, Yiğit Can YILMAZ@@yilmazcanyigit, K宝@@Pwnrin, Tong Liu@@Lyutoon_, 风(binary_fmyy), F00L, Cristian Dinca(Computer Science), Romania, 风沐云烟 (binary_fmyy), Kirin, FlowerCode, Pedro José Pereira Vieito / pvieito.com)@@pvieito, Apple, Lukas Bernhard, Tashita Software Security, Xiangwei Zhang(Tencent Security YUNDING LAB), linjy(HKUS3Lab), chluo(WHUSecLab), Brendon Tiszka(Google Project Zero)
Affected Software
26 affected componentsFixes available
Apple iPadOS<17.7.6
Apple iPadOS>=18.0<18.4
Apple iPhone OS<18.4
Apple macOS<13.7.5
Apple macOS>=14.0<14.7.5
Apple macOS>=15.0<15.4
Apple tvOS<18.4
Apple visionOS<2.4
Apple WatchOS<11.4
Apple macOS Sequoia
Apple tvOS
Apple macOS Ventura
Apple iPadOS>=17.7.6<=18.4
Apple macOS Sonoma
Apple iOS
Apple WatchOS
Apple visionOS
Apple visionOS<2.4
2.4
Apple macOS Ventura<13.7.5
13.7.5
Apple tvOS<18.4
18.4
Apple iOS<18.4
18.4
Apple iPadOS<18.4
18.4
Apple macOS Sequoia<15.4
15.4
Apple iPadOS<17.7.6
17.7.6
Apple macOS Sonoma<14.7.5
14.7.5
Apple WatchOS<11.4
11.4
Event History
Mar 31, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
Apr 1, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Apr 29, 2025
CVE Published
via MITRE·02:05 AM
Data Sourced
via MITRE·02:05 AM
DescriptionWeakness
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-24251?
CVE-2025-24251 is considered a critical severity vulnerability that could lead to unexpected app termination.
2
How do I fix CVE-2025-24251?
To fix CVE-2025-24251, update your device to the latest versions of macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, watchOS 11.4, or visionOS 2.4.
3
What devices are affected by CVE-2025-24251?
CVE-2025-24251 affects devices running macOS Sequoia, tvOS, macOS Ventura, iPadOS, macOS Sonoma, iOS, watchOS, and visionOS.
4
What is the potential impact of CVE-2025-24251?
An attacker on the local network may exploit CVE-2025-24251 to cause an unexpected termination of applications.
5
When was CVE-2025-24251 fixed?
CVE-2025-24251 was fixed in the respective software updates released on the specified version dates for each affected platform.