CVE-2025-24129
Published: 27 January 2025
Summary
CVE-2025-24129 is a high-severity Type Confusion (CWE-843) vulnerability in Apple Ipados. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 29.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the type confusion vulnerability by requiring timely identification, reporting, and correction of flaws through patching to the fixed Apple OS versions.
Protects against the denial-of-service impact by implementing mechanisms to limit effects of network-based attacks causing app termination.
Mitigates type confusion by enforcing validation of network inputs to prevent malformed data from triggering incorrect type handling.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion vulnerability enables remote unauthenticated exploitation causing app termination/DoS on affected Apple systems, directly matching T1499.004 Application or System Exploitation under Endpoint Denial of Service.
NVD Description
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may cause…
more
an unexpected app termination.
Deeper analysisAI
CVE-2025-24129 is a type confusion vulnerability (CWE-843) that was addressed with improved checks in multiple Apple operating systems. The affected components include iOS prior to version 18.3, iPadOS prior to 18.3, macOS Sequoia prior to 15.3, macOS Sonoma prior to 14.7.5, macOS Ventura prior to 13.7.5, tvOS prior to 18.3, and visionOS prior to 2.3. The vulnerability was published on 2025-01-27.
An unauthenticated attacker on the local network can exploit this issue to cause an unexpected app termination, leading to a denial-of-service condition. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network accessibility, low attack complexity, no privileges or user interaction required, and high impact on availability with no effects on confidentiality or integrity.
Apple's security advisories confirm the issue is fixed in the listed versions and recommend updating affected devices. Key references include https://support.apple.com/en-us/122066, https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122072, https://support.apple.com/en-us/122073, and https://support.apple.com/en-us/122374.
Details
- CWE(s)