CVE-2025-24097

Apple OS Permission Flaw Allows Arbitrary File Metadata Disclosure

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to read arbitrary file metadata.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 1 more

CVE-2025-24214

Potential Access to Sensitive User Data via Text Field Logging on Apple Devices

A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24202

Sensitive Data Exposure via Improper Logging in Apple Operating Systems

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-24193

Limited Access to Photos via USB‑C on Unlocked Devices in iOS/iPadOS

This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked device may be able to programmatically access photos.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os

CVE-2025-30447

Logging Sanitization Flaw Allowing Access to Sensitive User Data

The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24215

Potential Private Information Disclosure in iPadOS and macOS

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Macos

CVE-2025-24167

Improper Download Origin Association in Apple Mobile and Desktop Platforms

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Safari

CVE-2025-30445

Type Confusion Causes Unexpected App Termination via Local Network Attack

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24206

Local Network Authentication Bypass via Improper State Management

An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to bypass authentication policy.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24271

Unauthenticated AirPlay Command Injection on Local Network

An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24270

Local Network Information Disclosure in Apple Operating Systems

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to leak sensitive user information.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-31197

Local Network App Termination via Improper Resource Release

The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24091

App Can Impersonate System Notifications and Cause Denial of Service

An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os

CVE-2025-31235

Double Free Leading to Unexpected System Termination in iPadOS and macOS

A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to cause unexpected system termination.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Macos

CVE-2025-31238

Memory Corruption via Malicious Web Content in Apple Safari and iOS Ecosystem

The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 4 more

CVE-2025-31214

Potential Network Traffic Interception via Improper State Management in iOS/iPadOS

This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker in a privileged network position may be able to intercept network traffic.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os

CVE-2025-31234

Improper Input Sanitization Leading to Kernel Memory Corruption in Apple Systems

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-31209

Out‑of‑Bounds Read in File Parsing Leads to User Information Disclosure in Apple Operating Systems

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 3 more

CVE-2025-31233

Malformed Video File Input Sanitization Flaw Causes App Termination or Memory Corruption

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.

CVSS 3.1 · 6.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 3 more

CVE-2025-31225

Privacy Leak: Deleted App Call History Appears in Spotlight Search

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in spotlight search results.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os