SecuriTricks - CVE-2025-24137

Description

A type confusion issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A remote attacker may cause an unexpected application termination or arbitrary code execution.

Product(s) Impacted

Product	Versions
visionOS	['2.3']
watchOS	['11.3']
tvOS	['18.3']
iPadOS	['17.7.4', '18.3']
iOS	['18.3']
macOS	['Sonoma 14.7.3', 'Sequoia 15.3']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References

https://support.apple.com/en-us/122066

https://support.apple.com/en-us/122067

https://support.apple.com/en-us/122068

https://support.apple.com/en-us/122069

https://support.apple.com/en-us/122071

https://support.apple.com/en-us/122072

https://support.apple.com/en-us/122073

CVSS Score

8.0 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Jan. 27, 2025, 10:15 p.m.
Last Modified: Jan. 28, 2025, 8:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

product-security@apple.com

CVE-2025-24137