CVE-2025-24085

🗓️ 27 Jan 2025 21:45:46Reported by appleType

cve🔗 web.nvd.nist.gov📰️ 18 Media mentions👁 398 Views🌐 WEB

Use after free vulnerability fixed in Apple systems; may allow privilege escalation in older iOS.

Reporter	Title	Published	Views	Family All 53
GithubExploit	Exploit for Use After Free in Apple Ipados	23 Aug 202505:08	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Apple Safari	30 Aug 202502:21	–	githubexploit
ATTACKERKB	CVE-2025-24085	27 Jan 202500:00	–	attackerkb
Apple	About the security content of visionOS 2.3	27 Jan 202500:00	–	apple
Apple	About the security content of iPadOS 17.7.6	31 Mar 202500:00	–	apple
Apple	About the security content of iOS 18.3 and iPadOS 18.3	27 Jan 202500:00	–	apple
Apple	About the security content of macOS Sequoia 15.3	27 Jan 202500:00	–	apple
Apple	About the security content of tvOS 18.3	27 Jan 202500:00	–	apple
Apple	About the security content of watchOS 11.3	27 Jan 202500:00	–	apple
Apple	About the security content of iOS 18.3 and iPadOS 18.3	27 Jan 202500:00	–	apple

NVD

Vulners

Node

apple ipadosRange<17.7.6

apple ipadosRange18.0–18.3

apple iphone_osRange<18.3

apple macosRange13.0–13.7.5

apple macosRange14.0–14.7.5

apple macosRange15.0–15.3

apple tvosRange<18.3

apple visionosRange<2.3

apple watchosRange<11.3

[
  {
    "vendor": "Apple",
    "product": "iOS and iPadOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "18.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "iPadOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "17.7.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "macOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "13.7.5",
        "versionType": "custom"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "14.7.5",
        "versionType": "custom"
      },
      {
        "version": "0",
        "status": "affected",
        "lessThan": "15.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "tvOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "18.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "visionOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "watchOS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "11.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
support	www.support.apple.com/en-us/122071
support	www.support.apple.com/en-us/122066
support	www.support.apple.com/en-us/122372
support	www.support.apple.com/en-us/122374
support	www.support.apple.com/en-us/122073
support	www.support.apple.com/en-us/122375
support	www.support.apple.com/en-us/122068
support	www.support.apple.com/en-us/122072
seclists	www.seclists.org/fulldisclosure/2025/Jun/19
github	www.github.com/cisagov/vulnrichment/issues/194

Parameter	Position	Path	Description	CWE
ProgramArguments	path	/Library/LaunchDaemons/com.apple.securemonitor.plist	Hijack/replace LaunchDaemon plist to point to the payload script for privilege escalation	CWE-416
RunAtLoad	path	/Library/LaunchDaemons/com.apple.securemonitor.plist	Hijack/replace LaunchDaemon plist to point to the payload script for privilege escalation	CWE-416
#!/bin/bash	path	/tmp/.macroot_payload.sh	Root payload script created for persistence and privilege escalation	CWE-416
Root payload components	path	/tmp/.macroot_payload.sh	Root payload script created for persistence and privilege escalation	CWE-416
RunAsRoot	path	/tmp/.macroot_payload.sh	Root payload script created for persistence and privilege escalation	CWE-416
Label	path	/Library/LaunchDaemons/com.apple.backdoor.plist	Persistent backdoor plist created under LaunchDaemons for root access	CWE-416
ProgramArguments	path	/Library/LaunchDaemons/com.apple.backdoor.plist	Persistent backdoor plist created under LaunchDaemons for root access	CWE-416
RunAtLoad	path	/Library/LaunchDaemons/com.apple.backdoor.plist	Persistent backdoor plist created under LaunchDaemons for root access	CWE-416

17 Jun 2026 08:58Current

7.2High risk

Vulners AI Score7.2

CVSS 3.110

EPSS0.18668

SSVC