CVE-2025-24159
Published: 27 January 2025
Summary
CVE-2025-24159 is a high-severity Code Injection (CWE-94) vulnerability in Apple Ipados. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the validation issue enabling code injection by requiring organizations to validate inputs to applications and system processes.
Mandates timely flaw remediation through patching, aligning with Apple's release of fixed OS versions to eliminate the kernel privilege escalation vulnerability.
Enforces a reference monitor to mediate all access attempts, preventing an exploited app from executing arbitrary code with kernel privileges.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local code injection flaw (CWE-94) that allows an unprivileged app to execute arbitrary code with kernel privileges on Apple platforms, directly mapping to exploitation for privilege escalation.
NVD Description
A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to execute arbitrary…
more
code with kernel privileges.
Deeper analysisAI
CVE-2025-24159 is a validation issue addressed through improved logic in multiple Apple operating systems, enabling an app to execute arbitrary code with kernel privileges. The vulnerability affects iOS prior to version 18.3, iPadOS prior to 18.3 or 17.7.4, macOS Sequoia prior to 15.3, macOS Sonoma prior to 14.7.3, tvOS prior to 18.3, visionOS prior to 2.3, and watchOS prior to 11.3. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-94 (code injection), though NVD provides no additional CWE details.
Exploitation requires a local attacker with low-complexity access and no privileges, but user interaction is necessary. Successful exploitation grants kernel-level code execution, resulting in high impacts to confidentiality, integrity, and availability, potentially allowing full system compromise on affected devices.
Apple security advisories recommend updating to the fixed versions: iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, or watchOS 11.3. Detailed patch information is available in the referenced support articles at https://support.apple.com/en-us/122066, https://support.apple.com/en-us/122067, https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122069, and https://support.apple.com/en-us/122071.
Details
- CWE(s)