CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
Description
CVE-2025-24201 is a critical out-of-bounds write vulnerability in Apple WebKit that allows maliciously crafted web content to break out of the Web Content sandbox. This vulnerability affects a wide range of Apple products including iOS, iPadOS, macOS Sequoia, Safari, visionOS, and watchOS. Apple has acknowledged that CVE-2025-24201 may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before 17.2, and this fix serves as a supplementary patch. With a CVSS v3.1 score of 10.0 (the maximum possible) and CISA inclusion in the Known Exploited Vulnerabilities catalog, this represents one of the most severe WebKit vulnerabilities ever disclosed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 18.3.1 |
| apple | macos | >= 15.0, < 15.3.2 |
| apple | visionos | < 2.3.2 |
| apple | watchos | < 11.4 |
| apple | ipados | >= 15.8, < 15.8.4; >= 16.7, < 16.7.11; >= 17.0, < 17.7.6; >= 18.0, < 18.3.2 |
| apple | iphone os | >= 15.8, < 15.8.4; >= 16.7, < 16.7.11; >= 17.0, < 18.3.2 |
| debian | debian linux | 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://support.apple.com/en-us/122281(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122283(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122284(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122285(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122345(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122346(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122372(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122376(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/16(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/7(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jun/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Mar/2(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Mar/3(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Mar/4(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Mar/5(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/1(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/31(Mailing List, Third Party Advisory)
- https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201(Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/194(Issue Tracking)
- https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24201(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2025-24201 is classified under CWE-787 (Out-of-bounds Write), a vulnerability that occurs when software writes data to a memory location outside the intended buffer boundaries. In Apple WebKit, the out-of-bounds write condition allows maliciously crafted web content to corrupt memory in a way that enables breaking out of the Web Content sandbox, which is designed to isolate web page rendering from the rest of the operating system. Out-of-bounds write consistently ranks as the #1 most dangerous software weakness in the CWE Top 25.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2025-24201 carries the maximum CVSS score of 10.0, reflecting catastrophic impact across all dimensions. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) or user interaction (UI:N), and has Changed scope (S:C), meaning the attack breaks out of WebKit's sandbox to affect the broader operating system. Confidentiality (High) is compromised as sandbox escape enables access to all data on the device including photos, messages, credentials, and enterprise data. Integrity (High) is impacted because the attacker can install persistent malware, modify system files, and execute arbitrary code with elevated privileges. Availability (High) is threatened as the attacker gains full device control. The extremely low EPSS score of 0.07% at the 21st percentile contrasts with the confirmed exploitation, reflecting the highly targeted nature of this attack — it was used against specific individuals rather than in widespread campaigns. The scope change from WebKit sandbox to full OS access makes this vulnerability exceptionally dangerous.
Exploit Maturity
CVE-2025-24201 has confirmed exploitation in the wild. Apple has acknowledged the vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2." This characterization suggests the exploit was developed and used by a well-resourced threat actor, likely a nation-state or commercial spyware vendor. CISA has confirmed active exploitation by adding CVE-2025-24201 to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 3, 2025. While the EPSS score of 0.07% is low, this reflects the highly targeted nature of the exploit rather than its severity. The sophistication required for a WebKit sandbox escape combined with the targeted exploitation pattern is characteristic of commercial spyware platforms. Apple notes this is a supplementary fix for an attack that was initially blocked in iOS 17.2, indicating the exploit chain was known to Apple and partially mitigated before the full fix was available.
Remediation
-
Update all Apple devices immediately to the patched versions: iOS 18.3.2, iPadOS 18.3.2, iPadOS 17.7.6, iPadOS 16.7.11, iOS 16.7.11, iOS 15.8.4, iPadOS 15.8.4, macOS Sequoia 15.3.2, Safari 18.3.1, visionOS 2.3.2, and watchOS 11.4. Deploy updates through MDM for enterprise-managed devices.
-
Prioritize updates for high-risk users including executives, journalists, activists, government officials, and anyone who may be targeted by sophisticated threat actors. The confirmed exploitation against "specific targeted individuals" suggests a spyware-class threat.
-
Enable Lockdown Mode on iOS and macOS for users at elevated risk of targeted attacks. Lockdown Mode restricts WebKit functionality and other attack surfaces, providing additional protection against zero-day exploits.
-
Review device logs and indicators for any signs of compromise on devices that were running vulnerable versions, particularly those belonging to high-risk individuals. Check for unusual app installations, unexpected network connections, and battery drain patterns that may indicate surveillance software.
-
Implement web content filtering at the network level to reduce exposure to maliciously crafted web content. Deploy enterprise content filters that can inspect and block suspicious web traffic patterns targeting WebKit vulnerabilities.
Technical Details
CVE-2025-24201 is an out-of-bounds write vulnerability in Apple WebKit, the browser engine powering Safari and all web views across Apple platforms. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H assigns the maximum score of 10.0, reflecting the network-accessible, zero-interaction sandbox escape with complete impact across all CIA dimensions and Changed scope. The vulnerability allows maliciously crafted web content to trigger an out-of-bounds write that corrupts memory in a way that enables breaking out of the Web Content sandbox — a critical security boundary in Apple's architecture that isolates web page rendering from the rest of the operating system. A sandbox escape in WebKit means the attacker can transition from executing JavaScript within a web page to executing native code outside the sandbox, effectively gaining control of the device. Apple describes this as a supplementary fix for an attack initially blocked in iOS 17.2, indicating the vulnerability was part of an exploit chain used for targeted surveillance. The wide range of affected products (iOS, iPadOS, macOS, Safari, visionOS, watchOS) reflects WebKit's use as the universal browser engine across the Apple ecosystem.
Frequently Asked Questions
Is CVE-2025-24201 being actively exploited?
Yes. Apple has confirmed the vulnerability may have been exploited in an "extremely sophisticated attack against specific targeted individuals." CISA has added it to the KEV catalog. The exploitation pattern is consistent with commercial spyware operations targeting high-value individuals.
What products are affected by CVE-2025-24201?
Multiple Apple products are affected: Safari before 18.3.1, macOS Sequoia before 15.3.2, visionOS before 2.3.2, watchOS before 11.4, iPadOS versions across multiple branches (15.8, 16.7, 17.7, 18.3), and corresponding iOS versions. Debian Linux 11.0 is also listed due to WebKitGTK.
How do I fix CVE-2025-24201?
Update all Apple devices to the latest patched versions. For high-risk users, enable Lockdown Mode for additional protection against targeted WebKit exploits. Enterprise environments should deploy updates through MDM as a priority.
How severe is CVE-2025-24201?
CVE-2025-24201 has the maximum CVSS score of 10.0 (Critical). It enables a WebKit sandbox escape that transitions from web content processing to full device compromise. The Changed scope and zero-interaction requirements make this one of the most dangerous WebKit vulnerabilities ever disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.