CVE-2025-24085KEV · OVERDUE

Apple Multiple Products Use-After-Free Vulnerability

Critical · published January 27, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 97.1th percentile for exploit probability.

612
days past CISA
deadline
CVSS v3.1
10.0
EPSS
18%
Percentile
97.1
In the wild
Confirmed
What it is

🚨 A dangerous use-after-free vulnerability lurks in older versions of iOS and macOS, potentially letting malicious apps elevate privileges! 🔥 Think of it as a construction site where workers left behind a ladder that should have been taken down. A clever intruder could use that forgotten ladder to gain access to parts of the building they shouldn't be in. An attacker exploiting this vulnerability could gain elevated privileges, compromising sensitive data and system integrity — it’s like handing over the keys to the kingdom! If you're running any affected versions below iOS 17.2, your data could be at serious risk.

Put simply

Think of it as a construction site where workers left behind a ladder that should have been taken down. A clever intruder could use that forgotten ladder to gain access to parts of the building they shouldn't be in. This use-after-free issue was caused by improper memory management, allowing attackers to execute arbitrary code with escalated privileges through malicious apps.

What to do

An attacker exploiting this vulnerability could gain elevated privileges, compromising sensitive data and system integrity — it’s like handing over the keys to the kingdom! If you're running any affected versions below iOS 17.2, your data could be at serious risk. Update immediately to iOS 18.3, iPadOS 18.3, or the latest versions of macOS (Sequoia 15.3, Sonoma 14.7.5, Ventura 13.7.5) to mitigate the risk. Regularly check for and apply security updates to stay protected! You've got this! Follow these steps and you'll keep your devices safe from this threat. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17510 · 97.1th percentile
Published
2025-01-27T21:45Z
KEV added
2025-01-29 · due 2025-02-19
EPSS history
Timeline
  • 29 JAN 00:00Z
    Added to CISA KEV — remediate by Feb 19
    kev
  • 27 JAN 21:45Z
    A use after free issue was addressed with improved memory management
    cvelistv5