This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apple fixes over 140 vulnerabilities in various products

Apple fixes over 140 vulnerabilities in its products. A selection of the most severe is below; the remaining ones are described at [1][2][3][4][5][6][7][8][9][10][11][12]. Products and their fixed versions: macOS - 13.7.5 [1], 14.7.5 [2], 15.4 [3] iOS - 15.8.4 [4], 16.7.11 [5], 18.4 [6] iPadOS - 15.8.4 [4], 16.7.11 [5], 17.7.6 [7], 18.4 [6] watchOS - 11.4 [8] tvOS - 18.4 [9] visionOS - 2.4 [10] Safari - 18.4 [11] Xcode - 16.3 [12]

Apple macOS - privilege escalation (CVE-2025-24234, CVE-2025-24277)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to implementation flaws in the AccountPolicy and Crash Reporter components in macOS, to gain root privileges using social engineering [13][14].

The vulnerability is present in product:

  • macOS:macOS;>=13.0,<13.7.5;>=14.0,<14.7.5;>=15.0,<15.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

Apple macOS - RCE (CVE-2025-24228)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to a buffer overflow in the SMB (Server Message Block) protocol in macOS, to execute code with kernel privileges using social engineering [15].

The vulnerability is present in product:

  • macOS:macOS;>=13.0,<13.7.5;>=14.0,<14.7.5;>=15.0,<15.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-24228 at cve.org, NVD
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org

The vulnerability was publicly disclosed 31. 3. 2025.

Apple iOS, iPadOS, macOS - privilege escalation (CVE-2025-30456)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to insufficient input path validation in the DiskArbitration component in iOS, iPadOS and macOS, to gain root privileges using social engineering [16].

The vulnerability is present in products:

  • macOS:macOS;<13.7.5;>=14.0,<14.7.5;>=15.0,<15.4;
  • iOS:iOS;<18.4;
  • iPadOS:iPadOS;<18.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

Apple iOS, iPadOS, macOS, tvOS - privilege escalation (CVE-2025-24238)
CVSS 7.8 (High)

Allows an authenticated local attacker, due to a logic error in the libxpc library in iOS, iPadOS, macOS and tvOS, to elevate their privileges [17][18].

The vulnerability is present in products:

  • macOS:macOS;>=13.0;<13.7.5;>=14.0,<14.7.5;>=15.0,<15.4;
  • iOS:iOS;<18.4;
  • iPadOS:iPadOS;<18.4;
  • tvOS:tvOS;<18.4;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

Apple iOS, iPadOS, macOS, visionOS - DoS, kernel memory write (CVE-2025-24257)
CVSS 8.1 (High)

Allows an unauthenticated remote attacker, due to an out-of-bounds write in the IOGPUFamily component in iOS, iPadOS, macOS and visionOS, to carry out a DoS attack on the system or write to kernel memory [19].

The vulnerability is present in products:

  • macOS:macOS;>=15.0,<15.4;
  • iOS:iOS;<18.4;
  • iPadOS:iPadOS;<18.4;
  • visionOS:visionOS;<2.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 10. 4. 2025.

CESNET, z.s.p.o. Logo