CVE-2025-24131

Local Network Denial-of-Service via Improper Memory Handling in Apple Operating Systems

Published Jan 27, 2025 CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Description

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to cause a denial-of-service.

Analysis

Technical impact

This vulnerability stems from improper memory handling that can trigger a buffer overflow (CWE‑120) in several Apple operating systems. The flaw can cause the operating system to crash or become unresponsive, leading to a denial of service for legitimate users.

Affected Systems

Apple operating systems affected include iOS, iPadOS, macOS, tvOS, and visionOS. The issue has been fixed in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, and visionOS 2.3. Devices running older releases remain vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score of 1% suggests a very low probability of exploitation at the time of the analysis. The vulnerability is not listed in the CISA KEV catalog, meaning there are no known large-scale attacks. The attack vector is inferred to be local network connectivity, so an adversary would need physical or network access to the target device to exploit the flaw. The overall risk is moderate but largely limited to environments where local network access is possible.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.3

Apple

iPadOS

affected

Version	Status	Constraints
`0`	affected	< 17.7.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 13.7.5
`0`	affected	< 14.7.5
`0`	affected	< 15.3

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 18.3

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 2.3

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the Apple OS updates that include the memory‑handling fix for the relevant version (iOS 18.3, iPadOS 18.3/17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, or visionOS 2.3).
Reboot the device after applying the update to ensure the changes take effect.
Implement network segmentation or firewall rules to restrict local network access to the device, reducing the chances a local attacker can reach the vulnerable component.

Generated by OpenCVE AI on June 18, 2026 at 03:03 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3641	The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An attacker in a privileged position may be able to perform a denial-of-service.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.3% (1.268% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Jan/13
http://seclists.org/fulldisclosure/2025/Jan/15
http://seclists.org/fulldisclosure/2025/Jan/18
http://seclists.org/fulldisclosure/2025/Jan/19
https://support.apple.com/en-us/122066
https://support.apple.com/en-us/122068
https://support.apple.com/en-us/122072
https://support.apple.com/en-us/122073
https://support.apple.com/en-us/122372
https://support.apple.com/en-us/122374
https://support.apple.com/en-us/122375

History

Jun 18, 2026 4:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Network Denial-of-Service via Improper Memory Handling in Apple Operating Systems

Jun 17, 2026 12:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Local Buffer Overflow Leading to Denial of Service on Apple OS

Jun 16, 2026 6:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Buffer Overflow Leading to Denial of Service on Apple OS

Apr 2, 2026 8:30 PM Description updated. References updated View changes

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An attacker in a privileged position may be able to perform a denial-of-service.	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to cause a denial-of-service.
References	https://support.apple.com/en-us/122071	https://support.apple.com/en-us/122372 https://support.apple.com/en-us/122374 https://support.apple.com/en-us/122375

Nov 3, 2025 9:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Jan/13 http://seclists.org/fulldisclosure/2025/Jan/15 http://seclists.org/fulldisclosure/2025/Jan/18 http://seclists.org/fulldisclosure/2025/Jan/19

Feb 5, 2025 3:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-120
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 30, 2025 6:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ipados Apple iphone Os Apple macos Apple tvos Apple visionos Apple watchos
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple Apple ipados Apple iphone Os Apple macos Apple tvos Apple visionos Apple watchos
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Jan 27, 2025 10:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An attacker in a privileged position may be able to perform a denial-of-service.
References		https://support.apple.com/en-us/122066 https://support.apple.com/en-us/122068 https://support.apple.com/en-us/122071 https://support.apple.com/en-us/122072 https://support.apple.com/en-us/122073