CVE-2025-24167

This issue was addressed through improved state management

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

🚨 A mismanaged download origin could lead to sneaky exploits! This vulnerability in Safari and other Apple platforms means that files may be incorrectly linked — a potential recipe for disaster! 🔥 Think of it like a restaurant that serves the wrong dish because the order ticket was misread. If your meal isn’t what you ordered, you might end up with something you didn’t want — or worse, something harmful! An attacker could leverage this flaw to trick users into downloading malicious files, leading to serious compromises of personal data and device security. Imagine unwittingly inviting a hacker into your digital home — absolutely devastating!

Put simply

Think of it like a restaurant that serves the wrong dish because the order ticket was misread. If your meal isn’t what you ordered, you might end up with something you didn’t want — or worse, something harmful! This vulnerability arises from improper state management, where the origin of a download isn’t verified correctly, potentially allowing for unauthorized access to malicious content.

What to do

An attacker could leverage this flaw to trick users into downloading malicious files, leading to serious compromises of personal data and device security. Imagine unwittingly inviting a hacker into your digital home — absolutely devastating! Immediately update Safari to version 18.4, along with iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and watchOS 11.4. Ensuring that all devices are up to date is crucial for maintaining security! You've got this! Patch those devices and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00919 · 59.9th percentile
Published
2025-03-31T22:24Z
EPSS history
Timeline
  • 31 MAR 22:24Z
    This issue was addressed through improved state management
    cvelistv5