CVE-2025-24085
KEVCRITICAL 10.0EPSS 17.5%
A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
- Affected
- Apple · iOS and iPadOS · iPadOS · macOS · tvOS · visionOS · watchOS
- CVSS v3.1 NVD
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 17.51% chance of exploitation in the next 30 days, 97th percentile
- CISA KEV
- added 2025-01-29
- Published
- 2025-01-27
- Updated
- 2026-04-02
Proof-of-concept exploits (2)
- 5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-242015★ · 2025-08-30
- b1n4r1b01/n-days533★ · 2025-09-28
ExploitDB entries (1)
Security advisories
- https://support.apple.com/en-us/122066
- https://support.apple.com/en-us/122068
- https://support.apple.com/en-us/122071
- https://support.apple.com/en-us/122072
- https://support.apple.com/en-us/122073
- https://support.apple.com/en-us/122372
- https://support.apple.com/en-us/122374
- https://support.apple.com/en-us/122375
- http://seclists.org/fulldisclosure/2025/Apr/10
- http://seclists.org/fulldisclosure/2025/Apr/5
- http://seclists.org/fulldisclosure/2025/Apr/9
- http://seclists.org/fulldisclosure/2025/Jan/12
- http://seclists.org/fulldisclosure/2025/Jan/13
- http://seclists.org/fulldisclosure/2025/Jan/15
- http://seclists.org/fulldisclosure/2025/Jan/19
- http://seclists.org/fulldisclosure/2025/Jun/19
- http://seclists.org/fulldisclosure/2025/Oct/1
- http://seclists.org/fulldisclosure/2025/Oct/23
- http://seclists.org/fulldisclosure/2025/Oct/30
- http://seclists.org/fulldisclosure/2025/Oct/31
- JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201
- cisagov/vulnrichment/issues/194