CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

CVE-2025-24201 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2025-03-13

An out-of-bounds write vulnerability in WebKit allows maliciously crafted web content to bypass the Web Content sandbox. This flaw can be exploited by remote attackers to perform unauthorized actions or achieve code execution outside of the restricted environment.

Technologies: Apple Multiple Products. Vendors: Apple.

Quick answers

Is CVE-2025-24201 exploited in the wild?
Yes. CVE-2025-24201 is known to be exploited in the wild, first recorded on 13 March 2025. Treat it as urgent.
How severe is CVE-2025-24201?
Critical severity, with a CVSS score of 10, published 13 March 2025.
Which products and versions are affected?
Apple Safari before 18.3.1; Apple iOS and iPadOS before 15.8.4, 16.7.11, 18.3.2, and iPadOS 17.7.6; Apple macOS Sequoia before 15.3.2; Apple visionOS before 2.3.2; and 2 more.
Is there a fix for CVE-2025-24201?
A patch was published on 2025-03-13: Fixed in Safari 18.3.1, iOS 18.3.2, macOS 15.3.2, and other versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24201 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-24201?
Check whether you run Apple Multiple Products. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Apple Safari before 18.3.1
  • Apple iOS and iPadOS before 15.8.4, 16.7.11, 18.3.2, and iPadOS 17.7.6
  • Apple macOS Sequoia before 15.3.2
  • Apple visionOS before 2.3.2
  • Apple watchOS before 11.4
  • Apple WebKit

Timeline

  • 2025-03-13: disclosed
  • 2025-03-13: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2025-03-13: patched: Fixed in Safari 18.3.1, iOS 18.3.2, macOS 15.3.2, and other versions.
  • exploited: Apple reported awareness of exploitation in sophisticated attacks against targeted individuals on iOS versions prior to 17.2.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.