{"id":"CVE-2025-24201","published":"2025-03-11T18:15:30Z","modified":"2026-06-17T08:58:17Z","title":"Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability","vendor":"Apple","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).","provenance":"source","from":"NVD"},"summary":{"text":"An out-of-bounds write flaw in WebKit, the browser engine used across Apple's multiple products, allows malicious web content to escape the Web Content sandbox. An attacker can exploit it remotely over the network with no privileges or authentication required, and it needs only that a user is induced to load the crafted web content.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:09Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.03847,"percentile":0.90107,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-03-13","dueDate":"2025-04-03","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.apple.com/en-us/122281 ; https://support.apple.com/en-us/122283 ; https://support.apple.com/en-us/122284 ; https://support.apple.com/en-us/122285 ; ; https://nvd.nist.gov/vuln/detail/CVE-2025-24201","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-11","exploitedFirstSeen":"2025-03-11","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-03-11"},{"url":"https://support.apple.com/en-us/122281","date":"2025-03-11"},{"url":"https://support.apple.com/en-us/122283","date":"2025-03-11"},{"url":"https://support.apple.com/en-us/122284","date":"2025-03-11"},{"url":"https://support.apple.com/en-us/122285","date":"2025-03-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-13"},{"url":"https://support.apple.com/en-us/122345","date":"2025-03-31"},{"url":"https://support.apple.com/en-us/122346","date":"2025-03-31"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://support.apple.com/en-us/122281","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122283","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122284","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122285","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122345","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122346","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122372","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122376","tags":["Release Notes","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/16","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Jun/19","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Mar/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Mar/3","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Mar/4","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Mar/5","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Oct/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Oct/31","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/vulnrichment/issues/194","tags":["Issue Tracking"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24201","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"An out-of-bounds zero-day flaw exists in WebKit that adversaries have been exploiting via specially crafted web content to escape the Web Content sandbox.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"primary_impact","evidence":[],"comment":"An out-of-bounds zero-day flaw exists in WebKit that adversaries have been exploiting via specially crafted web content to escape the Web Content sandbox.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-6302","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6302","exploited":true,"exploitedSince":"2025-03-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-07-11","earliestUrl":"https://github.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","repos":[{"name":"The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","url":"https://github.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","stars":6,"created":"2025-07-11"},{"name":"5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201","url":"https://github.com/5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201","stars":5,"created":"2025-08-30"}]},"first":{"date":"2025-07-11","source":"PoC-in-GitHub","url":"https://github.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"related","techniques":["T1189"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2025-03-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24201","provenance":"source"},{"date":"2025-03-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2025-03-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6302","provenance":"source"},{"date":"2025-07-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","provenance":"source"}],"speed":{"daysToPublicExploit":122,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 598 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.02,"detail":"percentile 0.9011"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}