CVE-2025-24201

CRITICALCISA KEV

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-24201 has a selected CVSS score of 10.0 (critical); EIP currently links 3 repository PoCs. CISA lists CVE-2025-24201 in KEV.

Description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Mar 13, 2025 · CISA
VulnCheck KEV
Listed · Mar 11, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
3

CISA SSVC decision

ExploitationActive
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 12, 2025 · Source: CVE List

Affected products and versions

7
ProductSourceVersion range

Multiple Products

Browse Apple / Multiple Products
CISAVersion data not supplied

Safari

Browse Apple / Safari
CVE ListBefore 18.3.1affected

iOS and iPadOS

Browse Apple / iOS and iPadOS
CVE ListBefore 15.8.4affected
Before 16.7.11affected
Before 18.3.2affected

iPadOS

Browse Apple / iPadOS
CVE ListBefore 17.7.6affected

macOS

Browse Apple / macOS
CVE ListBefore 15.3.2affected

visionOS

Browse Apple / visionOS
CVE ListBefore 2.3.2affected

watchOS

Browse Apple / watchOS
CVE ListBefore 11.4affected

Proofs of concept

3

Repository PoCs

GitHubThe-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-Repository PoCby The-Maxu6Not analyzed2 files

4.4 KiB

GitHub
PoC details
GitHubJGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201Repository PoCby JGoyd40Writeup4 files

1.3 MiB · linked to 3 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a zero-click PNG exploit chain for iOS 18.2.1, involving CVE-2025-43300, CVE-2025-24201, and CVE-2025-24085. It details the attack stages, indicators of compromise, and a timeline, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a README.md documentation file describing an exploit chain. It contains no executable code, no instructions to execute anything, and no concealed payload. The text describes exploit behavior against Apple iOS, which is the stated target, and does not exhibit backdoor or deceptive behavior aimed at the reader.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesen
Target softwareiOSiPadOSmacOStvOSvisionOSwatchOSSafariWebKitCore MediaImageIOiMessage
Attack typeszero-clickremote code executionprivilege escalationsandbox escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a narrative description of an exploit chain, including CVE identifiers, a summary, a timeline, and indicators of compromise. It does not contain any source code, scripts, or executable instructions that would constitute an exploit or a scanner. The content is purely a technical writeup.

README.md:1-108

Requirements

  • Target must be running a vulnerable version of iOS (e.g., 18.2.1) or other affected Apple operating system.README.md:8
  • Attacker must be able to deliver a malicious PNG image via iMessage to the target.README.md:19

Observed behavior

  • A malicious PNG image sent via iMessage triggers automatic parsing, leading to heap corruption.README.md:19
  • The exploit chain achieves remote code execution through WebKit.README.md:36
  • The chain performs a sandbox escape and kernel-level privilege escalation, providing root access.README.md:21
  • The attack can establish persistence, exfiltrate keychain data, and brick the device.README.md:21
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldA VirusTotal link is provided for a hash, but the hash is not present in the supplied text and the link is not an executable payload.README.md:10-11
Url
Payload withheldA link to a video on archive.org, described as log evidence. The video content is not supplied and cannot be reviewed.README.md:25
Review boundaries

What the analysis did not establish

  • The artifact contains only a README.md file; no exploit or scanner source code is present.
  • Two binary files (CNVD certificates) are present but were not analyzed, and their content is not described in the text.
  • The analysis is based solely on the supplied text; the described exploit chain was not executed or verified.
  • Two binary files (CNVD-2025-06744 Certificate, CNVD-2025-07885 Certificate) were present in the artifact but were not inspected per binary policy.
  • One text file (likely a license or similar) was present but its content was not included in the evidence packet.
  • External links (VirusTotal, archive.org video) were not fetched or analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201Repository PoCby 5ky9uy5Not analyzed4 files

1.3 MiB · linked to 2 vulnerabilities

GitHub
PoC details

References

Showing 12 of 22