Buffer overflow in Apple iOS and iPadOS - CVE-2025-24126
Published: January 27, 2025
Vulnerability identifier: #VU103332
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-24126
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in AirPlay. A remote attacker on the local network can send specially crafted input to the device, trigger memory corruption and execute arbitrary code on the target system.
Affected software
Apple iOS
iPadOS
visionOS
watchOS
macOS
tvOS
iPadOS
visionOS
watchOS
macOS
tvOS
How to mitigate CVE-2025-24126
Install updates from vendor's website.
Apple iOS - update to 18.3 22D60
iPadOS - update to 18.3 22D60
visionOS - update to 2.3
watchOS - update to 11.3
macOS - addressed in versions 13.7.5 22H527, 14.7.5 23H527, 15.3 24D60
tvOS - update to 18.3
iPadOS - update to 18.3 22D60
visionOS - update to 2.3
watchOS - update to 11.3
macOS - addressed in versions 13.7.5 22H527, 14.7.5 23H527, 15.3 24D60
tvOS - update to 18.3
External References
Related Security Bulletins
- Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
- Multiple vulnerabilities in Apple tvOS
- Multiple vulnerabilities in Apple watchOS
- Multiple vulnerabilities in macOS Sequoia
- Multiple vulnerabilities in Apple visionOS
- Multiple vulnerabilities in macOS Ventura
- Multiple vulnerabilities in macOS Sonoma