CVE-2025-24201criticalunder attackCWE-787

CVE-2025-24201: critical vulnerability in Apple Safari

Published 11 Mar 2025 · Updated 02 Apr 2026

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 10epss 3.8%

from disclosure to weapon122 days

Published on NVDMar 11

1st PoC+122d

CISA KEV+2d

exploitation probability

3.8%top 10% of all CVEs

observed exploitation

yesCISA + VulnCheck

3 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

2 products (9 components)

Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6

workaround: Systems which do not rely on a GUI for system administration (commonly referred to as "headless") should confirm that GNOME shell and WebKitGTK are not present on the system…

Fixed

15 products (458 components)

Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream E4S (v.8.6) · Red Hat Enterprise Linux AppStream E4S (v.9.0) · Red Hat Enterprise Linux AppStream EUS (v.8.8) · and others 10

fix ↗

Action required by CISAfederal deadline: 2025-04-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A memory writing flaw in Safari and Apple operating systems allows malicious websites to escape the security sandbox that normally isolates web content, potentially giving attackers full control of your device.

Technical detail

An out-of-bounds write vulnerability (CWE-787) in WebKit's rendering engine enables sandbox escape when processing maliciously crafted web content. The vulnerability affects multiple Apple platforms and requires user interaction (visiting a malicious website); successful exploitation bypasses Web Content sandbox restrictions and grants arbitrary code execution with system privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Apple · iOS and iPadOS Apple · iPadOS Apple · macOS Apple · Safari Apple · visionOS Apple · watchOS

public PoCs found — 3

githubgithub.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-★ 6 githubgithub.com/5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201★ 5 vulncheckvulncheck.com/xdb/b9d4450ffbeeunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Apple Safari

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEV CVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEV CVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEV CVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEV CVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEV CVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV

References