PT-2025-1300 · Apple · Tvos+5
Pattern-F
·
Published
2025-01-27
·
Updated
2025-12-30
·
CVE-2025-24085
CVSS v3.1
10
Critical
| AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apple products versions prior to visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3.
Description
A use-after-free issue exists in the Core Media component of Apple products. This issue allows a malicious application to potentially elevate privileges. Apple is aware of reports that this issue has been actively exploited against versions of iOS prior to iOS 17.2. The vulnerability has been actively exploited in the wild and is associated with a zero-day exploit. The exploit involves a malicious iMessage containing a specially crafted HEIF image, bypassing BlastDoor and triggering a WebKit remote code execution, potentially leading to unauthorized keychain access and network redirection.
Recommendations
Update to visionOS 2.3 or later.
Update to iOS 18.3 or later.
Update to iPadOS 18.3 or later.
Update to macOS Sequoia 15.3 or later.
Update to watchOS 11.3 or later.
Update to tvOS 18.3 or later.
Exploit
Fix
DoS
LPE
RCE
Use After Free
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apple Macos
Ios
Ipados
Tvos
Visionos
Watchos