This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apple fixes over 70 vulnerabilities
Apple fixes over 70 vulnerabilities in its products. The most serious ones are described below; the remaining ones can be found at [1][2][3][4][5][6][7][8][9][10][11]. An overview of all vulnerabilities can be found at [12]. Products and their fixed versions: macOS - 13.7.3 [1], 14.7.3 [2], 15.3 [3] iOS - 18.3.1 [4][5] iPadOS - 17.7.5 [6][7], 18.3.1 [4][5] watchOS - 11.3 [8] tvOS - 18.3 [9] visionOS - 2.3 [10] Safari - 18.3 [11]
An unauthenticated remote attacker can carry out a DoS attack when files are parsed by Audio, CoreMedia and CoreAudio in macOS, iOS, iPadOS, visionOS, watchOS and tvOS [13][14][15][16].
The vulnerability is present in products:
- macOS:macOS;<13.7.3;>=14,<14.7.3;>=15,<15.3
- iOS:iOS;<18.3
- iPadOS:iPadOS;<17.7.4;>=18,<18.3
- visionOS:visionOS;<2.3
- watchOS:watchOS;<11.3
- tvOS:tvOS;<18.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-24106 at cve.org, NVD
- CVE-2025-24123 at cve.org, NVD
- CVE-2025-24124 at cve.org, NVD
- CVE-2025-24163 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
Due to a non-atomic kernel memory update and a time-of-use (TOCTOU) race condition in macOS and iPadOS, an unauthenticated local attacker can escalate privileges up to root, corrupt memory, potentially execute code or cause a kernel panic [17][18]. Exploitation is possible using a multithreaded attack that repeatedly changes the process's privileges. Detailed technical information about the vulnerability and a PoC exploit verified on Intel systems can be found at [18][19][20][21].
The vulnerability is present in products:
- macOS:macOS;>=14,<14.7.3;>=15,<15.3
- iPadOS:iPadOS;<17.7.4
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2025-24118 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
An unauthenticated remote attacker can make unauthorized modifications to protected parts of the file system in macOS via PackageKit [22].
The vulnerability is present in product:
- macOS:macOS;<13.7.3;>=14,<14.7.3;>=15,<15.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-24130 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
An unauthenticated remote attacker can escalate the privileges of an application in macOS via System Extensions [23].
The vulnerability is present in product:
- macOS:macOS;>=15,<15.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-24135 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
An unauthenticated local attacker, using social engineering, can escalate the privileges of a malicious application via CoreMedia in iOS, iPadOS, macOS, visionOS, watchOS and tvOS. Apple is aware of active exploitation of this vulnerability in iOS versions before 17.2 [24].
The vulnerability is present in products:
- macOS:macOS;>=15,<15.3
- iOS:iOS;<18.3
- iPadOS:iPadOS;<18.3
- visionOS:visionOS;<2.3
- watchOS:watchOS;<11.3
- tvOS:tvOS;<18.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-24085 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
A physical unauthenticated attacker can disable USB Restricted Mode on a locked iOS or iPadOS device, which may lead to unauthorized access to the device. Apple is aware that the vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals [25][26][27]. A detailed analysis of the vulnerability is available at [28].
The vulnerability is present in products:
- iOS:iOS;<18.3.1
- iPadOS:iPadOS;< 17.7.5;>=18,<18.3.1
CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-24200 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2025.
Due to an out-of-bounds write in macOS, iOS, iPadOS and visionOS, an unauthenticated remote attacker can corrupt kernel memory or carry out a DoS attack [29].
The vulnerability is present in products:
- macOS:macOS;<13.7.3;>=14,<14.7.3;>=15,<15.3
- iOS:iOS;<18.3.1
- iPadOS:iPadOS;<18.3.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2025-24154 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 27. 1. 2025.
An authenticated local attacker can bypass the Kernel Address Space Layout Randomization (KASLR) security mechanism in macOS and obtain information about the kernel memory layout, which may facilitate the exploitation of other vulnerabilities [30][31]. A detailed analysis of the vulnerability and a PoC exploit tested on Apple Silicon are available at [31][32].
The vulnerability is present in product:
- macOS:macOS;<15.2
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-54531 at cve.org, NVD
- CWE-200: Information Exposure at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
Links
- [1] https://support.apple.com/en-gb/122070
- [2] https://support.apple.com/en-gb/122069
- [3] https://support.apple.com/en-gb/122068
- [4] https://support.apple.com/en-gb/122174
- [5] https://support.apple.com/en-gb/122066
- [6] https://support.apple.com/en-gb/122173
- [7] https://support.apple.com/en-gb/122067
- [8] https://support.apple.com/en-gb/122071
- [9] https://support.apple.com/en-gb/122072
- [10] https://support.apple.com/en-gb/122073
- [11] https://support.apple.com/en-gb/122074
- [12] https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-011
- [13] https://nvd.nist.gov/vuln/detail/CVE-2025-24123
- [14] https://nvd.nist.gov/vuln/detail/CVE-2025-24124
- [15] https://nvd.nist.gov/vuln/detail/CVE-2025-24163
- [16] https://nvd.nist.gov/vuln/detail/CVE-2025-24106
- [17] https://www.rewterz.com/threat-advisory/poc-released-for-critical-apple-macos-kernel-vulnerability-cve-2025-24118
- [18] https://jprx.io/cve-2025-24118/
- [19] https://www.rescana.com/post/critical-analysis-of-cve-2025-24118-exploiting-race-condition-vulnerabilities-in-macos-kernel
- [20] https://github.com/jprx/CVE-2025-24118
- [21] https://github.com/rawtips/-CVE-2025-24118
- [22] https://nvd.nist.gov/vuln/detail/CVE-2025-24130
- [23] https://nvd.nist.gov/vuln/detail/CVE-2025-24135
- [24] https://nvd.nist.gov/vuln/detail/CVE-2025-24085
- [25] https://support.apple.com/en-us/122173
- [26] https://support.apple.com/en-us/122174
- [27] https://nvd.nist.gov/vuln/detail/CVE-2025-24200
- [28] https://blog.quarkslab.com/first-analysis-of-apples-usb-restricted-mode-bypass-cve-2025-24200.html
- [29] https://nvd.nist.gov/vuln/detail/CVE-2025-24154
- [30] https://nvd.nist.gov/vuln/detail/CVE-2024-54531
- [31] https://dl.acm.org/doi/pdf/10.1145/3658644.3690189
- [32] https://github.com/koreacsl/SysBumps
By CESNET, z.s.p.o. Michaela Ručková on 14. 2. 2025.