CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
Description
CVE-2025-24085 is a critical-severity use-after-free vulnerability affecting multiple Apple products including iOS, iPadOS, macOS, watchOS, tvOS, and visionOS that allows a malicious application to escalate privileges. With a CVSS v3.1 base score of 10.0 — the maximum possible score — the flaw stems from improper memory management where freed memory is subsequently accessed, enabling arbitrary code execution with elevated privileges. Apple has confirmed that this issue may have been actively exploited against versions of iOS before iOS 17.2. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 19, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 28.43% at the 96.4th percentile indicates very high exploitation probability across the Apple ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 17.7.6; >= 18.0, < 18.3 |
| apple | iphone os | < 18.3 |
| apple | macos | >= 13.0, < 13.7.5; >= 14.0, < 14.7.5; >= 15.0, < 15.3 |
| apple | tvos | < 18.3 |
| apple | visionos | < 2.3 |
| apple | watchos | < 11.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://support.apple.com/en-us/122066(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122068(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122071(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122072(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122073(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122372(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122374(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122375(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/10(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/5(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/9(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jan/12(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jan/13(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jan/15(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jan/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jun/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/1(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/23(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/30(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/31(Mailing List, Third Party Advisory)
- https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201(Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/194(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24085(US Government Resource)
Weakness Type
Unknown CWE
CVE-2025-24085 does not have a specific CWE assigned in the NVD database, but Apple describes it as a use-after-free vulnerability addressed through improved memory management. Use-after-free (UAF) vulnerabilities occur when a program continues to reference a memory location after it has been freed, potentially accessing data that has been reallocated for a different purpose. In the context of this Apple vulnerability, the UAF condition allows a malicious application to manipulate the freed memory region, placing attacker-controlled data in the location that the system still references. When the system subsequently accesses this stale pointer, it operates on the attacker's data as if it were a legitimate internal structure, enabling the attacker to redirect execution flow and escalate privileges beyond what the application's sandbox should permit. UAF vulnerabilities are among the most dangerous memory safety issues because they are often reliably exploitable and can bypass modern exploit mitigations. Learn more about Use After Free
Impact Analysis
The impact of CVE-2025-24085 is catastrophic across all three dimensions of the CIA triad, with the maximum CVSS base score of 10.0 reflecting a changed scope that extends the impact beyond the vulnerable component. Confidentiality is fully compromised because privilege escalation from a malicious application allows access to all data on the device, including photos, messages, emails, health data, keychain credentials, banking applications, and any other sensitive information stored on or accessible from the compromised Apple device.
Integrity suffers maximum impact because elevated privileges enable modification of any data, installation of persistent implants, manipulation of system settings, injection of code into other applications, and tampering with security mechanisms. On iOS devices, a privilege escalation of this nature can bypass the application sandbox entirely, granting the attacker the ability to modify the operating system itself and install surveillance capabilities that persist across application restarts.
Availability is critically threatened as full system control enables the attacker to disrupt device functionality, lock users out of their devices, wipe data, or use the compromised device as a persistent foothold for further attacks. The EPSS score of 28.43% at the 96.4th percentile, combined with Apple's explicit acknowledgment that the vulnerability was actively exploited against iOS versions before 17.2, confirms real-world weaponized exploitation. The breadth of affected products — spanning iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, watchOS 11.3, tvOS 18.3, and visionOS 2.3 — means that virtually every Apple device in the ecosystem is a potential target. A proof-of-concept repository related to this vulnerability is available on GitHub.
Exploit Maturity
CVE-2025-24085 demonstrates confirmed exploit maturity through Apple's own acknowledgment that the vulnerability "may have been actively exploited against versions of iOS before iOS 17.2" and its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 19, 2025. The EPSS score of 28.43% at the 96.4th percentile reflects substantial exploitation activity across the Apple ecosystem. Apple has published security advisories for all affected products: iOS and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3, and visionOS 2.3.
The active exploitation prior to iOS 17.2 suggests that this vulnerability was used in targeted attacks, potentially by sophisticated threat actors or commercial spyware operators who specialize in iOS exploitation. Use-after-free vulnerabilities in Apple's operating systems are highly prized in the exploit market because they provide a reliable path to privilege escalation within the tightly controlled Apple ecosystem. The CISA KEV entry can be reviewed at the KEV catalog. The ransomware association is classified as unknown, which is expected given that ransomware targeting Apple mobile devices remains uncommon, but the privilege escalation capability is valuable for espionage, surveillance, and data theft campaigns targeting high-value individuals and organizations.
Remediation
-
Update all Apple devices to the latest operating system versions immediately. Install iOS 18.3 and iPadOS 18.3 on iPhones and iPads, macOS Sequoia 15.3 on compatible Macs (or macOS Sonoma 14.7.5 and macOS Ventura 13.7.5 for older systems), watchOS 11.3 on Apple Watches, tvOS 18.3 on Apple TVs, and visionOS 2.3 on Apple Vision Pro. Older devices that cannot update to these versions should update to iPadOS 17.7.6 where available.
-
Enable automatic updates on all managed Apple devices through MDM (Mobile Device Management) policies to ensure future security patches are applied promptly. Configure MDM to enforce minimum OS version requirements that match the patched versions to prevent devices with vulnerable firmware from accessing corporate resources.
-
Audit application installations on managed devices for any unauthorized or suspicious applications. Since exploitation requires a malicious application to be installed on the device, review application inventories for apps installed from outside the App Store (via enterprise provisioning profiles or sideloading) and investigate any unfamiliar applications.
-
Enforce application management policies that restrict installation of applications from untrusted sources. On managed iOS devices, disable the ability to install apps from outside the App Store. On macOS, configure Gatekeeper to only allow applications from the App Store and identified developers, and consider enabling full App Store restriction for high-security environments.
-
Monitor for indicators of compromise on devices that may have been running vulnerable iOS versions before 17.2. Use mobile threat detection solutions to scan for known exploitation artifacts, anomalous process behavior, or indicators of persistent implants. Devices suspected of compromise should be forensically examined before being returned to production use.
Technical Details
CVE-2025-24085 is a use-after-free vulnerability across multiple Apple operating systems, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability can be triggered through network-delivered content, such as a malicious application downloaded from the internet. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:N) indicates that no special privileges are needed beyond the ability to run an application on the device. User Interaction (UI:N) confirms no additional user action is required once the malicious application is installed. Scope (S:C) is changed, meaning the vulnerability in one component (the application sandbox) allows impact on a different security authority (the operating system kernel or privileged services), which is why the base score reaches the maximum of 10.0.
The use-after-free condition occurs in a component shared across Apple's operating system family. The vulnerable code path involves memory management where an object is freed but a reference (pointer) to it is retained and subsequently dereferenced. An attacker's malicious application can trigger the free operation and then allocate new memory in the same location, filling it with crafted data. When the stale reference is used, the system interprets the attacker's data as a legitimate internal structure, enabling controlled code execution outside the application's sandbox. Apple addressed the vulnerability by improving memory management to ensure that references are properly invalidated when their associated objects are freed. The fix was applied across all affected platforms: iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3, and visionOS 2.3, with additional backports to macOS Sonoma 14.7.5, macOS Ventura 13.7.5, and iPadOS 17.7.6.
Frequently Asked Questions
What is CVE-2025-24085?
CVE-2025-24085 is a critical use-after-free vulnerability affecting iOS, iPadOS, macOS, watchOS, tvOS, and visionOS that allows a malicious application to escalate privileges. It carries the maximum CVSS score of 10.0 and Apple has confirmed active exploitation prior to iOS 17.2.
Which Apple devices are affected by CVE-2025-24085?
Virtually all Apple devices are affected, including iPhones, iPads, Macs, Apple Watches, Apple TVs, and Apple Vision Pro. The fix is available in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, watchOS 11.3, tvOS 18.3, and visionOS 2.3.
Was CVE-2025-24085 exploited before the patch was released?
Yes, Apple explicitly states that the vulnerability "may have been actively exploited against versions of iOS before iOS 17.2." This indicates targeted exploitation by sophisticated threat actors, potentially including commercial spyware operators.
How can I protect my Apple devices from CVE-2025-24085?
Update all Apple devices to the latest operating system versions immediately. Enable automatic updates to receive future patches promptly. Avoid installing applications from untrusted sources, and use mobile device management solutions to enforce security policies across organizational devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.