CVE-2025-24085

Exploited in the wild. In CISA KEV since 2025‑01‑29. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile97th18% chance in 30 days CISA KEVListedsince 2025-01-29, due 2025-02-19
Public exploit: 1 source Fix5 products6 fixed builds listed below

Published 2025-01-27Updated 2025-11-14Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple iPadOSAffected: < 17.7.6Upgrade to: 17.7.6Stated by: CVE record
Apple iOS and iPadOSAffected: < 18.3Upgrade to: 18.3Stated by: CVE record
Apple macOSAffected: < 13.7.5Upgrade to: 13.7.5Affected: < 14.7.5Upgrade to: 14.7.5Affected: < 15.3Upgrade to: 15.3Stated by: CVE record
Apple tvOSAffected: < 18.3Upgrade to: 18.3Stated by: CVE record
Apple visionOSAffected: < 2.3Upgrade to: 2.3Stated by: CVE record

Versions as the sources state them. 1 more product has version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check the installed version on every company iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro.
Update iPhones to iOS 18.3 or later, and iPads to iPadOS 17.7.6 or later.
Update Macs to macOS Ventura 13.7.5, Sonoma 14.7.5, or Sequoia 15.3 or later; update Apple TVs to tvOS 18.3, Apple Watches to watchOS 11.3, and Apple Vision Pro devices to visionOS 2.3 or later.
Until updates are complete, prevent staff from installing or running unapproved apps and remove any untrusted apps already installed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Jan 29, 2025·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

In plain language

Written by AI from the record

This is a serious flaw in Apple devices running versions older than the listed security updates; small businesses should update affected devices urgently.

A use-after-free memory-management flaw permits privilege escalation by a malicious application executing on the device.

If you're affected

Device security bypass
Business data exposure
Unauthorized system changes
Operational disruption

What is it

This is a mistake in how an Apple device handles temporary working space while an app is running. It can let a malicious app gain access beyond its proper limits, like a visitor finding a way from the reception area into staff-only rooms.

Who is affected

This matters if your business uses Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS. It is only a risk if an attacker can get a malicious app installed or executed on the device.

How urgent is it

Attackers are already exploiting this vulnerability, and CISA has placed it on its known-exploited-vulnerabilities list. Treat this as a red-priority update: complete the updates across business-owned devices as soon as possible and verify that none were missed.

What to do — in detail

Confirm exposure by inventorying Apple-managed and personally owned devices used for work, then compare each installed OS version with the remediation targets. Update iOS to 18.3 or later; iPadOS to 17.7.6 or later; macOS Ventura to 13.7.5, Sonoma to 14.7.5, or Sequoia to 15.3 or later; tvOS to 18.3 or later; visionOS to 2.3 or later; and watchOS to 11.3 or later.

Use normal Apple Software Update or your device-management platform, and test any business-critical Mac software before broad deployment where your change-control process requires it. If patching is delayed, restrict installation and execution of unapproved applications, remove untrusted apps, and prioritize devices used for sensitive business data. CISA’s remediation due date was 2025-02-19. Monitor device-management reports for devices that remain below the target versions and investigate unexpected application installations or privilege-related alerts.

Technical context

CVE-2025-24085 is rated CVSS 10.0 (Critical) and is classified as CWE-416, use-after-free. Findings describe a network attack vector with no authentication or user interaction, while also identifying execution of a malicious application on the target as the practical precondition; successful exploitation enables local privilege escalation. It is listed in CISA KEV, meaning CISA has confirmed real-world exploitation and required federal civilian agencies to remediate by 2025-02-19. A public GitHub proof of concept is known; EPSS was 17.5% at the 97th percentile and falling, but confirmed exploitation takes precedence over that prediction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

Public exploit

CISA KEV

Listed as exploited in the wild since 2025-01-29.

US federal agencies must remediate by 2025-02-19.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

18% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 112 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-07Public exploit / PoCsource: github-poc
2025-11-14Patch availablerecord updated
2025-01-29Added to CISA KEV
2025-01-27Publishedweakness classified, att&ck mapped

Affected products

Apple Inc.commercial · USaka apple, apple computer
- iPadOSOSEmbeddedOperating Systems / mobile-os
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os
- macOSOSOn-premOperating Systems / unix-bsd
- tvOSOSEmbeddedOperating Systems / mobile-os
- visionOSOSOperating Systems / mobile-os
- watchOSOSEmbeddedOperating Systems / mobile-os

And 12 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable