CVE-2025-24085

critical

Description

A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

References

https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201

http://seclists.org/fulldisclosure/2025/Oct/31

http://seclists.org/fulldisclosure/2025/Oct/30

http://seclists.org/fulldisclosure/2025/Oct/23

http://seclists.org/fulldisclosure/2025/Oct/1

http://seclists.org/fulldisclosure/2025/Jun/19

http://seclists.org/fulldisclosure/2025/Jan/19

http://seclists.org/fulldisclosure/2025/Jan/15

http://seclists.org/fulldisclosure/2025/Jan/13

http://seclists.org/fulldisclosure/2025/Jan/12

http://seclists.org/fulldisclosure/2025/Apr/9

http://seclists.org/fulldisclosure/2025/Apr/5

http://seclists.org/fulldisclosure/2025/Apr/10

https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-ipads/

https://thehackernews.com/2025/08/apple-patches-cve-2025-43300-zero-day.html

https://securityaffairs.com/181394/security/apple-addressed-the-seventh-actively-exploited-zero-day.html

https://www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-new-actively-exploited-zero-day/

https://www.bleepingcomputer.com/news/security/apple-patches-security-flaw-exploited-in-chrome-zero-day-attacks/

https://thehackernews.com/2025/04/apple-patches-two-actively-exploited.html

https://www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/

https://www.securityweek.com/apple-patches-recent-zero-days-in-older-iphones/

https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-macs/

https://thehackernews.com/2025/04/apple-backports-critical-fixes-for-3.html

https://www.darkreading.com/mobile-security/apple-drops-another-webkit-zero-day-bug

https://www.bleepingcomputer.com/news/apple/apple-fixes-webkit-zero-day-exploited-in-extremely-sophisticated-attacks/

https://thehackernews.com/2025/03/apple-releases-patch-for-webkit-zero.html

https://www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-exploited-in-extremely-sophisticated-attacks/

https://thehackernews.com/2025/02/apple-patches-actively-exploited-ios.html

https://securityaffairs.com/174066/hacking/apple-fixes-iphone-and-ipad-bug-exploited-in-extremely-sophisticated-attacks.html

https://www.cisa.gov/news-events/alerts/2025/01/29/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.securityweek.com/apple-patches-first-exploited-ios-zero-day-of-2025/

https://thehackernews.com/2025/01/apple-patches-actively-exploited-zero.html

https://www.forbes.com/sites/kateoflahertyuk/2025/01/27/ios-183-update-now-warning-issued-to-all-iphone-users/

https://www.darkreading.com/endpoint-security/apple-patches-actively-exploited-zero-day-vulnerability

https://www.bleepingcomputer.com/news/security/apple-fixes-this-years-first-actively-exploited-zero-day-bug/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24085

https://support.apple.com/en-us/122073

https://support.apple.com/en-us/122072

https://support.apple.com/en-us/122071

https://support.apple.com/en-us/122068

https://support.apple.com/en-us/122066

https://github.com/cisagov/vulnrichment/issues/194

Details

Source: Mitre, NVD

Published: 2025-01-27

Updated: 2025-11-14

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.40348