CVE-2025-24161 - Vulnerability Details

- App Termination via Malformed File Parsing on Apple Platforms

Description

The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to an unexpected app termination.

Published: 2025-01-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from insufficient validation when parsing certain files, leading to an unexpected application termination. This results in a local denial‑of‑service condition where the affected application stops functioning without providing any data leakage or code execution capability. The weakness corresponds to CWE‑754, related to premature release or misuse of resources.

Affected Systems

Apple iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3 and watchOS 11.3 are addressed by updated releases. Earlier versions lacking these fixes are potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity level. With an EPSS score below 1% the probability of exploitation appears very low, and the vulnerability is not catalogued in the CISA KEV list. An attacker would likely need to supply a crafted file to a target application, possibly via local access or through file sharing mechanisms; remote exploitation is not suggested by the data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.3

Apple

iPadOS

affected

Version	Status	Constraints
`0`	affected	< 17.7.4

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.7.3
`0`	affected	< 15.3

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 18.3

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 2.3

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 11.3

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the latest OS release that includes the fix, e.g., iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3 or watchOS 11.3.
Ensure all third‑party apps that parse files are updated to versions compatible with the patched OS to eliminate local triggers.
If an immediate OS upgrade is not possible, restrict the use of the vulnerable application or disable file import features until the update is applied.

Generated by OpenCVE AI on April 28, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-3663	The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Jan/13
http://seclists.org/fulldisclosure/2025/Jan/14
http://seclists.org/fulldisclosure/2025/Jan/15
http://seclists.org/fulldisclosure/2025/Jan/16
http://seclists.org/fulldisclosure/2025/Jan/18
http://seclists.org/fulldisclosure/2025/Jan/19
https://support.apple.com/en-us/122066
https://support.apple.com/en-us/122067
https://support.apple.com/en-us/122068
https://support.apple.com/en-us/122069
https://support.apple.com/en-us/122071
https://support.apple.com/en-us/122072
https://support.apple.com/en-us/122073

History

Tue, 28 Apr 2026 04:15:00 +0000

Type	Values Removed	Values Added
Title		App Termination via Malformed File Parsing on Apple Platforms

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.	The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to an unexpected app termination.

Mon, 03 Nov 2025 21:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Jan/13 http://seclists.org/fulldisclosure/2025/Jan/14 http://seclists.org/fulldisclosure/2025/Jan/15 http://seclists.org/fulldisclosure/2025/Jan/16 http://seclists.org/fulldisclosure/2025/Jan/18 http://seclists.org/fulldisclosure/2025/Jan/19

Tue, 04 Feb 2025 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-754
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Jan 2025 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ipados Apple iphone Os Apple macos Apple tvos Apple visionos Apple watchos
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple Apple ipados Apple iphone Os Apple macos Apple tvos Apple visionos Apple watchos
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`

Mon, 27 Jan 2025 22:00:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
References		https://support.apple.com/en-us/122066 https://support.apple.com/en-us/122067 https://support.apple.com/en-us/122068 https://support.apple.com/en-us/122069 https://support.apple.com/en-us/122071 https://support.apple.com/en-us/122072 https://support.apple.com/en-us/122073

Subscriptions

Apple Ipados Iphone Os Macos Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-01-27T21:46:20.643Z

Updated: 2026-04-02T18:21:07.399Z

Reserved: 2025-01-17T00:00:44.987Z

Link: CVE-2025-24161

Vulnrichment

Updated: 2025-11-03T21:05:10.355Z

NVD

Status : Modified

Published: 2025-01-27T22:15:20.083

Modified: 2026-04-02T19:19:10.007

Link: CVE-2025-24161

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-28T04:00:05Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object