CVE-2025-24201: Apple WebKit out-of-bounds write allows sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 3.1 base score is 10.0 with changed scope, CISA KEV lists it as exploited, and Apple reports it may have been used in targeted attacks.

What it is

CVE-2025-24201 is an out-of-bounds write in Apple's WebKit that was addressed with improved checks. Maliciously crafted web content may break out of the Web Content sandbox, and Apple states the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS before 17.2. This is a supplementary fix for an attack that was blocked in iOS 17.2.

Impact

An attacker who lands the crafted web content can escape the Web Content sandbox, gaining code execution outside the browser or app rendering context. Given the sandbox escape and the CVSS vector's changed scope with high confidentiality, integrity and availability impact, the potential is full compromise of the affected device.

Attack surface

Reached remotely over the network by rendering maliciously crafted web content; the CVSS vector shows no privileges required and no user interaction, though in practice a target must load the content. No authentication is needed.

Exploitation

Apple states the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, and CISA added it to KEV on 2025-03-13 with a 2025-04-03 due date. EPSS 30-day probability is 0.03804 (89th percentile), and a public GitHub repository references the CVE alongside CVE-2025-24085.

What to do

• Update to the fixed versions: Safari 18.3.1, iOS/iPadOS 18.3.2, iOS/iPadOS 16.7.11, iOS/iPadOS 15.8.4, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4.
• Apply Debian fixes per the Debian LTS advisory for WebKit packages.
• Follow CISA BOD 22-01 guidance and meet the KEV remediation due date of 2025-04-03.
• Prioritize patching devices used by at-risk individuals, since exploitation has been reported against specific targeted individuals.
• If patching is not immediately possible, restrict browsing of untrusted web content on unpatched devices.

Detection

• Hunt for WebKit or Safari process crashes consistent with out-of-bounds writes on unpatched Apple devices.
• Monitor for unexpected child processes or code execution originating from WebKit content processes, which would indicate a sandbox escape.
• Track endpoint and MDM inventories for devices still below the fixed OS, Safari, visionOS and watchOS versions.
• Review network and endpoint telemetry for known exploitation indicators tied to targeted-individual campaigns, though no specific IOCs are provided in this record.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.