CVEs / CVE-2025-24201

CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Known exploited in the CISA KEV catalog since 13 Mar 2025
critical 10 CVSS 3.1 (NVD)
EPSS 3.84% chance of exploitation in the next 30 days, higher than 90% of CVEs (30 Oct 2026)
Last changed at its sources 17 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-24201

Summary

Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
CISA, Known Exploited Vulnerabilities catalog

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
The CVE record, via NVD · published 11 Mar 2025 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Apple Safari	before 18.3.1	18.3.1
Apple iOS and iPadOS	before 15.8.4	15.8.4
Apple iOS and iPadOS	before 16.7.11	16.7.11
Apple iOS and iPadOS	before 18.3.2	18.3.2
Apple iPadOS	before 17.7.6	17.7.6
Apple macOS	before 15.3.2	15.3.2
Apple visionOS	before 2.3.2	2.3.2
Apple watchOS	before 11.4	11.4

Exploitation

In CISA KEV since	13 Mar 2025
Due date for US federal agencies	3 Apr 2025
Used in ransomware campaigns	Unknown
Required action	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity

CVSS 3.1	10 critical `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` Scored by NVD
Weakness	CWE-787

References

CVE-2025-24201 on NVD
CVE-2025-24201 in the CISA KEV catalog
https://support.apple.com/en-us/122281 (cited by CISA)
https://support.apple.com/en-us/122283 (cited by CISA)
https://support.apple.com/en-us/122284 (cited by CISA)
https://support.apple.com/en-us/122285 (cited by CISA)
CVE-2025-24201 on OSV
https://support.apple.com/en-us/122281 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122283 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122284 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122285 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122345 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122346 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122372 Release Notes, Vendor Advisory
https://support.apple.com/en-us/122376 Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2025/Apr/16 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Apr/7 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jun/19 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Mar/2 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Mar/3 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Mar/4 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Mar/5 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/1 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/31 Mailing List, Third Party Advisory
https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201 Third Party Advisory
https://github.com/cisagov/vulnrichment/issues/194 Issue Tracking
https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html Mailing List

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.