10

CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

CVSS: 10.0v3.1CriticalKEVAnalyzed
AliasesSUSE-SU-2025:0974-1SUSE-SU-2025:0975-1SUSE-SU-2025:0993-1
Published 11-03-2025Last modified 02-04-2026
Open JSON

Vulnerability summary

CVE-2025-24201 is a critical (CVSS 10.0) Out-of-bounds Write vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 13-03-2025. EPSS estimates a 3.85% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
3.85%
0%100%
Low · +0.04 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 7
DLA-4218-1DSA-5877-1DSA-5885-1MGASA-2025-0313OPENSUSE-SU-2025:15531-1RHSA-2025:10364

Timeline

  1. 11-03-2025
    PublishedVulnerability first disclosed.
  2. 13-03-2025
    Added to CISA KEVApple Multiple Products WebKit Out-of-Bounds Write Vulnerability
  3. 03-04-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 02-04-2026
    Last modifiedVulnerability information updated.

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

3.85%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

+0.04 pp

From 3.80% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.85%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
13-03-2025
Federal due date
03-04-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.apple.com/en-us/122281 support.apple.com/en-us/122283 support.apple.com/en-us/122284 support.apple.com/en-us/122285 nvd.nist.gov/vuln/detail/CVE-2025-24201

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse36 products
  • webkit2gtk3-soup2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.46.6-150400.4.109.1
  • webkit2gtk3-soup2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.46.6-150400.4.109.1
  • webkit2gtk3-soup2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.46.6-150400.4.109.1
  • webkit2gtk3-soup2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.46.6-150400.4.109.1
  • webkit2gtk3-soup2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6< 2.46.6-150600.12.30.2
Redhat9 products
  • webkit2gtk3< 0:2.46.6-2.el8_10 | < 0:2.46.6-2.el9_5 | < 0:2.46.6-2.el9_4 | < 0:2.46.6-2.el8_8 | < 0:2.46.6-2.el9_0 | < 0:2.46.6-2.el9_2 | < 0:2.46.6-2.el8_2 | < 0:2.46.6-2.el8_4 | < 0:2.46.6-2.el8_6
  • webkit2gtk3-debuginfo< 0:2.46.6-2.el8_10 | < 0:2.46.6-2.el9_5 | < 0:2.46.6-2.el9_4 | < 0:2.46.6-2.el8_8 | < 0:2.46.6-2.el9_0 | < 0:2.46.6-2.el9_2 | < 0:2.46.6-2.el8_2 | < 0:2.46.6-2.el8_4 | < 0:2.46.6-2.el8_6
  • webkit2gtk3-debugsource< 0:2.46.6-2.el8_10 | < 0:2.46.6-2.el9_5 | < 0:2.46.6-2.el9_4 | < 0:2.46.6-2.el8_8 | < 0:2.46.6-2.el9_0 | < 0:2.46.6-2.el9_2 | < 0:2.46.6-2.el8_2 | < 0:2.46.6-2.el8_4 | < 0:2.46.6-2.el8_6
  • webkit2gtk3-devel< 0:2.46.6-2.el8_10 | < 0:2.46.6-2.el9_5 | < 0:2.46.6-2.el9_4 | < 0:2.46.6-2.el8_8 | < 0:2.46.6-2.el9_0 | < 0:2.46.6-2.el9_2 | < 0:2.46.6-2.el8_2 | < 0:2.46.6-2.el8_4 | < 0:2.46.6-2.el8_6
  • webkit2gtk3-devel-debuginfo< 0:2.46.6-2.el8_10 | < 0:2.46.6-2.el9_5 | < 0:2.46.6-2.el9_4 | < 0:2.46.6-2.el8_8 | < 0:2.46.6-2.el9_0 | < 0:2.46.6-2.el9_2 | < 0:2.46.6-2.el8_2 | < 0:2.46.6-2.el8_4 | < 0:2.46.6-2.el8_6
Apple7 products
  • ios and ipados< 15.8.4 | < 16.7.11 | < 18.3.2
  • ipados< 17.7.6 | ≥ 15.8, < 15.8.4 | ≥ 16.7, < 16.7.11 | ≥ 17.0, < 17.7.6 | ≥ 18.0, < 18.3.2
  • iphone_os≥ 15.8, < 15.8.4 | ≥ 16.7, < 16.7.11 | ≥ 17.0, < 18.3.2
  • macos< 15.3.2 | ≥ 15.0, < 15.3.2
  • safari< 18.3.1
Ubuntu5 products
  • qtwebkit-opensource-srcAll versions (No fix recorded)
  • qtwebkit-sourceAll versions (No fix recorded)
  • webkit2gtkAll versions (No fix recorded) | < 2.48.0-0ubuntu0.22.04.1 | < 2.48.0-0ubuntu0.24.04.1
  • webkitgtkAll versions (No fix recorded)
  • wpewebkitAll versions (No fix recorded)
Debian4 products
  • chromium< 134.0.6998.88-1~deb12u1
  • webkit2gtk< 2.48.0-1~deb12u1 | < 2.48.0-1
  • wpewebkitAll versions (No fix recorded) | < 2.48.0-1
  • debian_linuxEOL11.0
Opensuse3 products
  • webkit2gtk3-soup2&distro=openSUSE Leap 15.6< 2.46.6-150600.12.30.2
  • webkit2gtk3&distro=openSUSE Leap 15.6< 2.46.6-150600.12.30.2
  • webkit2gtk4&distro=openSUSE Leap 15.6< 2.46.6-150600.12.30.2

6 vendors · 64 products

References

55 links
Show all 55 references