Description
The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An attacker on the local network may cause an unexpected app termination.
Published: 2025-04-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Application Crash
Action: Update OS
AI Analysis

Impact

The vulnerability is a NULL pointer dereference that can be triggered by malicious local‑network traffic, causing unexpected termination of applications. This results in a denial of service for the affected processes but does not directly compromise confidentiality or integrity. It is classified as CWE‑476.

Affected Systems

Apple iOS 18.4 and earlier, iPadOS 18.4 and iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Any device running these operating systems is susceptible until the update is applied.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. With an EPSS below 1 % the likelihood of active exploitation is low. The vulnerability is not listed in the CISA KEV catalog. An attacker must have access to the same local network as the target device and be able to send crafted traffic that triggers the null dereference; no remote code execution is possible.

Generated by OpenCVE AI on April 28, 2026 at 11:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest OS updates listed above for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
  • Where updates cannot be applied immediately, isolate affected devices from untrusted local networks or apply network filtering to block traffic patterns that could exploit the bug.
  • Enable automatic OS updates or use device management to enforce timely patch deployment.

Generated by OpenCVE AI on April 28, 2026 at 11:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-12737 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, watchOS 11.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.
History

Tue, 28 Apr 2026 11:45:00 +0000

Type Values Removed Values Added
Title NULL Pointer Dereference Leading to App Crash via Local Network

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, watchOS 11.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination. The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An attacker on the local network may cause an unexpected app termination.

Wed, 30 Apr 2025 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Wed, 30 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 29 Apr 2025 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
Apple macos
Apple tvos
Apple visionos
Apple watchos
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os
Apple macos
Apple tvos
Apple visionos
Apple watchos

Tue, 29 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Apr 2025 02:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, watchOS 11.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.
References

Subscriptions

Apple Ipados Iphone Os Macos Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:13:10.567Z

Reserved: 2025-01-17T00:00:45.010Z

Link: CVE-2025-24251

cve-icon Vulnrichment

Updated: 2025-04-29T13:40:31.688Z

cve-icon NVD

Status : Modified

Published: 2025-04-29T03:15:34.510

Modified: 2026-04-02T19:19:27.630

Link: CVE-2025-24251

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T11:30:29Z

Weaknesses