CVE-2025-24085 | A use after free issue was addressed with improved memory ma… | CVSS 10.0 CRITICAL

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

Metadata

CVE ID: CVE-2025-24085
State: PUBLISHED
Assigner: apple
Reserved: 2025-01-17 00:00 UTC
Published: 2025-01-27 21:45 UTC
Last updated: 2026-04-02 18:13 UTC
Primary CWE: CWE-416
CWE-416 Use After Free
Vendor / Product: Apple / iOS and iPadOS
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: Apple Multiple Products Use-After-Free Vulnerability
Vendor: Apple
Product: Multiple Products
Added to KEV: 2025-01-29
Due date: 2025-02-19
Ransomware: Not known

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description

Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.

Affected products (6)

Vendor	Product	Platform	Versions
Apple	iOS and iPadOS	—	0 < 18.3
Apple	iPadOS	—	0 < 17.7.6
Apple	macOS	—	0 < 13.7.5, 0 < 14.7.5, 0 < 15.3
Apple	tvOS	—	0 < 18.3
Apple	visionOS	—	0 < 2.3
Apple	watchOS	—	0 < 11.3

Weakness (CWE)

CWE	Source	Description
—	cna	A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
CWE-416	adp	CWE-416 Use After Free

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (8)