CVE-2025-24201: Out of bounds write in GPU on Mac

Q: What is the severity of CVE-2025-24201?

CVE-2025-24201 is considered a critical vulnerability due to its potential to allow unauthorized actions through an out-of-bounds write issue.

Q: How do I fix CVE-2025-24201?

To mitigate CVE-2025-24201, upgrade to visionOS 2.3.2, iOS 18.3.2, iPadOS 18.3.2, or macOS Sequoia 15.3.2.

Q: What software versions are affected by CVE-2025-24201?

CVE-2025-24201 affects versions of visionOS prior to 2.3.2, iOS prior to 18.3.2, iPadOS prior to 18.3.2, and macOS Sequoia prior to 15.3.2.

Q: What type of attack can exploit CVE-2025-24201?

CVE-2025-24201 can be exploited through maliciously crafted web content allowing it to escape the Web Content sandbox.

Q: Which Apple product requires an update to address CVE-2025-24201?

Apple products including visionOS, iOS, iPadOS, macOS Sequoia, and Safari require an update to address CVE-2025-24201.

Published Mar 5, 2025

Updated

Accessibility. An authorization issue was addressed with improved state management.

Other sources

Accounts. This issue was addressed with improved data access restriction.

— Apple

AirDrop. A permissions issue was addressed with additional restrictions.

— Apple

AirPlay. A null pointer dereference was addressed with improved input validation.

— Apple

AirPlay. A type confusion issue was addressed with improved checks.

— Apple

AirPlay. A use-after-free issue was addressed with improved memory management.

— Apple

Credit

Apple, Apple Security Engineering, Architecture (SEAR), Bill Marczak(The Citizen Lab at The University of Toronto), an anonymous researcher, Paul Bakker(ParagonERP), Gary Kwong, rheza@@ginggilBesel, Francisco Alonso@@revskills, Lukas Bernhard, Tashita Software Security, Xiangwei Zhang(Tencent Security YUNDING LAB), linjy(HKUS3Lab), chluo(WHUSecLab), Brendon Tiszka(Google Project Zero), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc, Ron Masas(BREAKPOINT), Uri Katz (Oligo Security), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Dominik Rath, Martin Kreichgauer(Google Chrome), Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), pattern-f@@pattern_F_, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), CVE-2024-9681, Andr.Ess, Kirin@@Pwnrin, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Wang Yu(Cyberserval), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), CVE-2024-48958, CVE-2025-27113, CVE-2024-56171, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Jimmy, Mickey Jin@@patch1t, @@RenwaX23, Syarif Muhammad Sajjad, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Andrew James Gonzalez, Bohdan Stasiuk@@bohdan_stasiuk, CVE-2025-24085, Jax Reissner, Richard Hyunho Im with routezero.security@@richeeta, Lehan Dilusha@@zafer

Affected Software

56 affected componentsFixes available

Apple visionOS<2.3.2

2.3.2

Apple macOS Sequoia<15.3.2

15.3.2

Microsoft Edge<134.0.3124.62

Google Chrome<134.0.6998.88

134.0.6998.88

Apple Safari<18.3.1

18.3.1

Microsoft Edge (Chromium-based)

Patch available

Apple visionOS<2.3.2

Apple iOS<17.2

Apple iPadOS<17.2

Apple macOS Sequoia<15.3.2

Apple iOS<18.3.2

18.3.2

Apple iPadOS<18.3.2

18.3.2

Apple iOS<15.8.4

15.8.4

Apple iPadOS<15.8.4

15.8.4

Apple iOS<16.7.11

16.7.11

Apple iPadOS<16.7.11

16.7.11

Apple iPadOS<17.7.6

17.7.6

Apple WatchOS<11.4

11.4

Apple Safari<18.3.1

Apple macOS>=15.0<15.3.2

Apple visionOS<2.3.2

Apple WatchOS<11.4

Apple iPadOS>=15.8<15.8.4

Apple iPadOS>=16.7<16.7.11

Apple iPadOS>=17.0<17.7.6

Apple iPadOS>=18.0<18.3.2

Apple iPhone OS>=15.8<15.8.4

Apple iPhone OS>=16.7<16.7.11

Apple iPhone OS>=17.0<18.3.2

Debian Debian Linux=11.0

Apple Multiple Products