Description
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to cause a denial-of-service.
Published: 2025-04-29
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update OS
AI Analysis

Impact

A null pointer dereference was discovered in several Apple operating systems; the flaw occurs when input validation fails and a pointer is dereferenced without proper safety checks. The weakness can result in an application crash that interrupts normal operation, compromising the availability of the affected service or device. The vulnerability is formally identified as CWE-476, indicating a type safety error leading to predictable failure modes.

Affected Systems

Apple devices running iOS, iPadOS, macOS, tvOS, or visionOS are impacted. Versions prior to iOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, or visionOS 2.3 are vulnerable. The issue has been fixed by the corresponding official update releases on each platform.

Risk and Exploitability

The disclosed CVSS score of 5.7 reflects a moderate severity, while the EPSS score of less than 1% indicates a low chance of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker who can reach the device from a local network segment may trigger the dereference and cause a reboot or application termination, leading to denial of service. No additional access privileges or external networking are required for exploitation.

Generated by OpenCVE AI on April 28, 2026 at 18:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official updates for iOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, and visionOS 2.3 to eliminate the null pointer dereference.
  • Restrict local network access to the affected devices using firewall rules or VLAN segmentation so that only trusted network segments can reach services that may trigger the vulnerability.
  • Disable or restrict unnecessary local‑network services (e.g., device pairing or remote configuration tools) that could invoke the vulnerable code paths, thereby reducing the attack surface.

Generated by OpenCVE AI on April 28, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-12739 A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, visionOS 2.3, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Sequoia 15.3, tvOS 18.3. An attacker on the local network may be able to cause a denial-of-service.
History

Tue, 28 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Title Null Pointer Dereference Causing Denial of Service on Apple Operating Systems

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, visionOS 2.3, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Sequoia 15.3, tvOS 18.3. An attacker on the local network may be able to cause a denial-of-service. A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to cause a denial-of-service.

Wed, 30 Apr 2025 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 30 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Tue, 29 Apr 2025 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
Apple macos
Apple tvos
Apple visionos
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os
Apple macos
Apple tvos
Apple visionos

Tue, 29 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Apr 2025 02:30:00 +0000

Type Values Removed Values Added
Description A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, visionOS 2.3, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Sequoia 15.3, tvOS 18.3. An attacker on the local network may be able to cause a denial-of-service.
References

Subscriptions

Apple Ipados Iphone Os Macos Tvos Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:16:41.496Z

Reserved: 2025-01-17T00:00:44.992Z

Link: CVE-2025-24179

cve-icon Vulnrichment

Updated: 2025-04-29T13:32:47.936Z

cve-icon NVD

Status : Modified

Published: 2025-04-29T03:15:34.033

Modified: 2026-04-02T19:19:13.950

Link: CVE-2025-24179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T19:00:20Z

Weaknesses