CVE-2025-24237
Published: 31 March 2025
Summary
CVE-2025-24237 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements bounds checking on inputs to prevent buffer overflows, matching the exact fix applied in the CVE patches.
Requires timely identification, reporting, and patching of flaws like this critical buffer overflow vulnerability.
Provides memory protections such as non-executable memory and ASLR to mitigate exploitation attempts causing system termination.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow with remote network exploitation (AV:N, PR:N, UI:N) and potential RCE (high C/I impact) or DoS directly enables T1190 for initial access via public-facing or network-exposed components.
NVD Description
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. An app may be able to…
more
cause unexpected system termination.
Deeper analysisAI
CVE-2025-24237 is a buffer overflow vulnerability (CWE-120) that was addressed with improved bounds checking. It affects iOS versions prior to 18.4, iPadOS versions prior to 18.4 and 17.7.6, macOS Sequoia prior to 15.4, macOS Sonoma prior to 14.7.5, macOS Ventura prior to 13.7.5, visionOS prior to 2.4, and watchOS prior to 11.4. Published on 2025-03-31, the issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical severity.
A remote attacker with no privileges or user interaction can exploit this vulnerability over the network with low attack complexity. Exploitation by a malicious app may cause unexpected system termination, aligning with the high availability impact in the CVSS score, while also enabling potential high confidentiality and integrity impacts.
Apple's security advisories detail the patches in the listed updates. Mitigation involves applying these updates promptly. Additional information is available in the advisories at https://support.apple.com/en-us/122371, https://support.apple.com/en-us/122372, https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375.
Details
- CWE(s)