CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
- Critical 10.0
- Exploited: added to CISA KEV 29 Jan 2025
Description
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
Key facts
- Published
- 27 Jan 2025
- Last changed
- 2 Apr 2026
- Assigned by
- apple
- KEV added
- 29 Jan 2025
- KEV fix due
- 19 Feb 2025
- EPSS
- 17.401% likely to be exploited in the next 30 days, higher than 97.171% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: active; Automatable: yes; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 10.0CVSS 3.1, Criticalfrom CISA (ADP container)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Apple | iOS and iPadOS |
|
| Apple | iPadOS |
|
| Apple | macOS |
|
| Apple | tvOS |
|
| Apple | visionOS |
|
| Apple | watchOS |
|
Timeline
- 27 Jan 2025 Published
- 29 Jan 2025 Added to the CISA KEV catalogue