CVE-2025-24178

This issue was addressed through improved state management

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

🚨 An app might just slip through the cracks of its sandbox! This critical vulnerability allows it to break out, much like a sneaky cat finding an open window. 🔥 Think of an app as a well-behaved pet kept inside a secure yard. This vulnerability is akin to finding a loose board in the fence and making a dash for freedom, leading to potential chaos in your digital garden. If exploited, this flaw could allow an app to access data and resources beyond its intended limits, potentially leading to data leaks or unauthorized access to sensitive information. The stakes are high, as it could compromise both user security and privacy.

Put simply

Think of an app as a well-behaved pet kept inside a secure yard. This vulnerability is akin to finding a loose board in the fence and making a dash for freedom, leading to potential chaos in your digital garden. This issue, stemming from poor state management, allows apps on affected Apple platforms to escape their sandbox restrictions, giving them undue privileges and access.

What to do

If exploited, this flaw could allow an app to access data and resources beyond its intended limits, potentially leading to data leaks or unauthorized access to sensitive information. The stakes are high, as it could compromise both user security and privacy. To protect yourself, update to iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, and watchOS 11.4 immediately. Regularly check for further updates to ensure continued protection. 🛡️ You’ve got this! Stay proactive and keep your devices updated to lock this vulnerability down! 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01573 · 75.2th percentile
Published
2025-03-31T22:22Z
EPSS history
Timeline
  • 31 MAR 22:22Z
    This issue was addressed through improved state management
    cvelistv5