# CVE-2025-24085

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

- Page: https://www.vulneraibility.com/cve/CVE-2025-24085
- CVSS: 10.0
- Known exploited: yes, in CISA KEV since 2025-01-29; CISA due date 2025-02-19
- EPSS: 17.51%
- Public exploit code: 1 on Exploit-DB · 1 GitHub proof of concept (first 2025-06-05)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-11-12)
- Weakness: CWE-416
- Published: 2025-01-27

## Affected versions

- Apple iOS and iPadOS: affected < 18.3
- Apple iPadOS: affected < 17.7.6
- Apple macOS: affected < 13.7.5; < 14.7.5; < 15.3
- Apple tvOS: affected < 18.3
- Apple visionOS: affected < 2.3
- Apple watchOS: affected < 11.3

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.apple.com/en-us/122066
- [other] https://support.apple.com/en-us/122068
- [other] https://support.apple.com/en-us/122071
- [other] https://support.apple.com/en-us/122072
- [other] https://support.apple.com/en-us/122073
- [other] https://support.apple.com/en-us/122372
- [other] https://support.apple.com/en-us/122374
- [other] https://support.apple.com/en-us/122375
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24085
- [other] http://seclists.org/fulldisclosure/2025/Oct/30
- [other] http://seclists.org/fulldisclosure/2025/Oct/31
- [other] http://seclists.org/fulldisclosure/2025/Oct/23
- [other] http://seclists.org/fulldisclosure/2025/Oct/1
- [other] http://seclists.org/fulldisclosure/2025/Jun/19
- [other] http://seclists.org/fulldisclosure/2025/Apr/10
- [other] http://seclists.org/fulldisclosure/2025/Apr/9
- [other] http://seclists.org/fulldisclosure/2025/Apr/5
- [other] http://seclists.org/fulldisclosure/2025/Jan/19
- [other] http://seclists.org/fulldisclosure/2025/Jan/15
- [other] http://seclists.org/fulldisclosure/2025/Jan/13
- [other] http://seclists.org/fulldisclosure/2025/Jan/12
- [other] https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201
- [other] https://github.com/cisagov/vulnrichment/issues/194

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.