CVE-2025-24158
📋 TL;DR
This CVE describes a memory handling vulnerability in Apple's web content processing that could lead to denial-of-service. It affects multiple Apple operating systems and Safari browser. Users running vulnerable versions of visionOS, iOS, iPadOS, macOS, watchOS, tvOS, or Safari are at risk.
💻 Affected Systems
- visionOS
- Safari
- iOS
- iPadOS
- macOS Sequoia
- watchOS
- tvOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Safari by Apple
Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or application termination when processing malicious web content, potentially causing data loss or service disruption.
Likely Case
Browser or application crash when visiting a malicious website, requiring restart of the affected application.
If Mitigated
Minimal impact with proper patching and security controls in place.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious website) but no authentication. Apple has addressed the issue, suggesting potential for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3
Vendor Advisory: https://support.apple.com/en-us/122066
Restart Required: Yes
Instructions:
1. Open Settings/System Preferences. 2. Navigate to Software Update. 3. Install available updates for your Apple device. 4. Restart device if prompted.
🔧 Temporary Workarounds
Disable JavaScript
macosTemporarily disable JavaScript in Safari to prevent web content processing vulnerabilities.
Safari > Preferences > Security > Uncheck 'Enable JavaScript'
Use Alternative Browser
allUse a non-Safari browser until patches are applied.
🧯 If You Can't Patch
- Implement web content filtering to block malicious sites
- Restrict access to untrusted websites and enforce safe browsing policies
🔍 How to Verify
Check if Vulnerable:
Check current OS/browser version against vulnerable versions listed in affected_systems.versionsCheck Version:
macOS: sw_vers -productVersion, iOS/iPadOS: Settings > General > About > Version, Safari: Safari > About SafariVerify Fix Applied:
Verify OS/browser version matches or exceeds patched versions listed in fix_official.patch_version📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning Safari/WebKit processes
- System logs showing unexpected application termination
Network Indicators:
- Multiple requests to suspicious domains followed by application crashes
SIEM Query:
source="apple_system_logs" AND (process="Safari" OR process="WebKit") AND event="crash"🔗 References
- https://support.apple.com/en-us/122066
- https://support.apple.com/en-us/122068
- https://support.apple.com/en-us/122071
- https://support.apple.com/en-us/122072
- https://support.apple.com/en-us/122073
- https://support.apple.com/en-us/122074
- http://seclists.org/fulldisclosure/2025/Jan/13
- http://seclists.org/fulldisclosure/2025/Jan/15
- http://seclists.org/fulldisclosure/2025/Jan/18
- http://seclists.org/fulldisclosure/2025/Jan/20
- https://lists.debian.org/debian-lts-announce/2025/02/msg00014.html
