CVE-2025-24104: Input Validation
First published: Mon Jan 27 2025(Updated: )
Accessibility. An authentication issue was addressed with improved state management.
Credit: product-security@apple.com DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeUri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple(HyeongSeok Jang) Trend Micro Zero Day InitiativeKirin @Pwnrin Gary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeMinghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple(HyeongSeok Jang) Trend Micro Zero Day InitiativeKirin @Pwnrin Gary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeGary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple(HyeongSeok Jang) Trend Micro Zero Day InitiativeKirin @Pwnrin Gary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeHichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeDesmond Trend Micro Zero Day InitiativePwn2car & Rotiple(HyeongSeok Jang) Trend Micro Zero Day InitiativeKirin @Pwnrin Gary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin Gary Kwong DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n Joseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeMichael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day Initiativepattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeJoseph Ravichandran @0xjprx MIT CSAILpattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra Anonymous Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeUri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Google Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Abhay Kailasia @abhay_kailasia CUri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Uri Katz (Oligo Security) Minghao Lin @Y1nKoc Zhejiang Universitybabywu Zhejiang University Zhejiang UniversityXingwei Lin Zhejiang UniversityGoogle Threat Analysis Group Google Threat Analysis Group Google Threat Analysis Group Desmond Trend Micro Zero Day InitiativePwn2car & Rotiple (HyeongSeok Jang) Trend Micro Zero Day InitiativeCVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar) CVE-2025-24085 DongJun Kim @smlijun JongSeong Kim in Enki WhiteHat @nevul37 D4m0n an anonymous researcher pattern-f @pattern_F_ Michael (Biscuit) Thomas @social.lol) @biscuit Hichem Maloufi Hakim Boukhadra mastersplinter @RenwaX23 @RenwaX23 Michael DePlante @izobashi Trend Micro Zero Day InitiativeKirin @Pwnrin an anonymous researcher an anonymous researcher Q1IQ @q1iqF NUS CuriOSityP1umer @p1umer Imperial Global Singaporelinjy HKUS3Labchluo WHUSecLabJohan Carlsson (joaxcar)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iPadOS | <17.7.4 | |
| Apple iOS | <18.3 | |
| Apple iPadOS | <18.3 | |
| Apple iPadOS | <17.7.4 | 17.7.4 |
| Apple iOS | <18.3 | 18.3 |
| Apple iPadOS | <18.3 | 18.3 |
| <17.7.4 | ||
| >=18.0<18.3 | ||
| <18.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/122067 (Advisory)
- https://support.apple.com/en-us/122066 (Advisory)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2025-24137
- CVE-2025-24127
- CVE-2025-24161
- CVE-2025-24160
- CVE-2025-24163
- CVE-2025-24123
- CVE-2025-24124
- CVE-2025-24102
- CVE-2024-54478
- CVE-2025-24086
- CVE-2025-24118
- CVE-2025-24159
- CVE-2025-24117
- CVE-2025-24104
- CVE-2024-54497
- CVE-2025-24149
- CVE-2025-24141
- CVE-2025-24126
- CVE-2025-24129
- CVE-2025-24131
- CVE-2025-24177
- CVE-2025-24085
- CVE-2025-24107
- CVE-2024-9956
- CVE-2025-24128
- CVE-2025-24113
- CVE-2025-24145
- CVE-2025-24154
- CVE-2025-24143
- CVE-2025-24158
- CVE-2025-24162
- CVE-2025-24150
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/event
- collector/apple-support
- source/Apple
- alias/CVE-2025-24118
- alias/CVE-2025-24159
- alias/CVE-2025-24117
- alias/CVE-2025-24104
- alias/CVE-2024-54497
- alias/CVE-2025-24149
- alias/CVE-2025-24127
- alias/CVE-2025-24161
- alias/CVE-2025-24160
- alias/CVE-2025-24163
- alias/CVE-2025-24123
- alias/CVE-2025-24124
- alias/CVE-2025-24102
- alias/CVE-2024-54478
- alias/CVE-2025-24086
- alias/CVE-2025-24129
- alias/CVE-2025-24131
- alias/CVE-2025-24177
- alias/CVE-2025-24137
- alias/CVE-2025-24085
- alias/CVE-2025-24107
- alias/CVE-2024-9956
- alias/CVE-2025-24128
- alias/CVE-2025-24113
- alias/CVE-2025-24145
- alias/CVE-2025-24154
- alias/CVE-2025-24143
- alias/CVE-2025-24158
- alias/CVE-2025-24162
- alias/CVE-2025-24150
- alias/CVE-2025-24126
- agent/source
- agent/author
- agent/description
- agent/first-publish-date
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- vendor/apple
- canonical/apple ipados
- canonical/apple ios