CVE-2025-24177
Published: 27 January 2025
Summary
CVE-2025-24177 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Apple Ipados. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-24177 is a null pointer dereference vulnerability (CWE-476) that was addressed through improved input validation in multiple Apple operating systems. The affected software includes iOS versions prior to 18.3, iPadOS versions prior to 18.3 and 17.7.6, macOS Sequoia prior to 15.3, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. Published on 2025-01-27, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An attacker on the local network can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Exploitation leads to a denial-of-service condition, impacting availability while having no effect on confidentiality or integrity.
Apple's security advisories detail the fixes in the specified updates: iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Additional information is available at https://support.apple.com/en-us/122066, https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122372, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3670
Vulnerability details
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker on the local network may be able…
more
to cause a denial-of-service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null pointer dereference vulnerability exploitable over the network to cause denial-of-service via application/system crash, directly mapping to Endpoint Denial of Service through Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validating inputs to prevent null pointer dereferences from malformed network data, directly matching the CVE's root cause and fix.
Mandates timely flaw remediation through patching to the fixed Apple OS versions, eliminating the vulnerability.
Provides denial-of-service protection mechanisms to limit or block the impact of local network-triggered crashes from this vulnerability.