CVE-2025-24085: Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS Use-After-Free Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 10.0, CISA KEV listing with a short remediation deadline, and Apple's own statement of possible active exploitation make this a top remediation priority.

What it is

A use-after-free flaw in Apple's operating systems was fixed through improved memory management in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15.3, Sonoma 14.7.5, Ventura 13.7.5, tvOS 18.3, visionOS 2.3 and watchOS 11.3. Apple states it is aware of a report that the issue may have been actively exploited against iOS versions before 17.2. The record does not name the affected component or the exact code path.

Impact

A malicious application may be able to elevate privileges on the affected device. Successful exploitation gives the attacker code execution at a higher privilege level than the app should have.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:N, but the description states the flaw is triggered by a malicious application, so in practice the attacker needs a way to run code on the target device. No authentication or user interaction is indicated by the vector.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-01-29 with a due date of 2025-02-19, and Apple states it may have been actively exploited against iOS before 17.2. EPSS is 0.17648 (96.994th percentile), and a public GitHub repository references this CVE alongside CVE-2025-24201.

What to do

• Update to the fixed versions immediately: iOS 18.3, iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3.
• Treat any device still running iOS before 17.2 as compromised or at high risk and prioritize it for patching.
• Restrict installation of untrusted or sideloaded applications on managed Apple devices.
• Apply the CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Verify patch compliance across all Apple device fleets, including Macs, Apple TVs, Vision Pro and Watches, not just iPhones and iPads.

Detection

• Monitor for unexpected privilege escalation or process token changes on Apple endpoints.
• Hunt for crashes or anomalous memory behavior in processes that handle untrusted application input.
• Review endpoint telemetry for malicious or sideloaded applications executing on patched and unpatched devices.
• Check MDM or patch-management reports for devices still below the fixed OS versions listed in the advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.