CVE-2025-24213: Double Free

Q: What is the severity of CVE-2025-24213?

CVE-2025-24213 is classified as a moderate severity vulnerability due to accessibility and logging issues that could lead to information exposure.

Q: How do I fix CVE-2025-24213?

To fix CVE-2025-24213, update to the latest versions of the affected Apple products and software that have addressed the vulnerabilities.

Q: Which products are affected by CVE-2025-24213?

CVE-2025-24213 affects several Apple products including Safari, iOS, iPadOS, watchOS, macOS, and visionOS.

Q: What kind of issue does CVE-2025-24213 address?

CVE-2025-24213 addresses a logging issue that was improved with better data redaction and memory handling enhancements.

Q: Is there a workaround for CVE-2025-24213?

There are no known workarounds for CVE-2025-24213, so updating the software is recommended for protection.

Published Mar 31, 2025

Updated

Accessibility. A logging issue was addressed with improved data redaction.

Other sources

AccountPolicy. This issue was addressed by removing the vulnerable code.

— Apple

Accounts. This issue was addressed with improved data access restriction.

— Apple

afpfs. The issue was addressed with improved memory handling.

— Apple

afpfs. This issue was addressed with improved checks.

— Apple

AirDrop. A permissions issue was addressed with additional restrictions.

— Apple

Credit

Google V8 Security Team, Francisco Alonso@@revskills, an anonymous researcher, Muhammad Zaid Ghifari (Mr.ZheeV), Kalimantan Utara, rheza@@ginggilBesel, PixiePoint Security, Andreas Hegenberg (folivora.AI GmbH), Wojciech Regula(SecuRing), Dave G., Kirin@@Pwnrin, 7feilee, Eric Dorphy(Twin Cities App Dev LLC), Adam M., Ignacio Sanmillan@@ulexec, Jiming Wang, Jikai Ren, Gary Kwong, Paul Bakker(ParagonERP), Vsevolod Kokorin (Slonser)(Solidlab), Apple, Lukas Bernhard, Tashita Software Security, Xiangwei Zhang(Tencent Security YUNDING LAB), linjy(HKUS3Lab), chluo(WHUSecLab), Brendon Tiszka(Google Project Zero), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc, Uri Katz (Oligo Security), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Denis Tokarev@@illusionofcha0s, Google Threat Analysis Group, wac(Trend Micro Zero Day Initiative), pattern-f@@pattern_F_, Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), CVE-2024-9681, LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), CVE-2024-48958, CVE-2025-27113, CVE-2024-56171, Alex Radocea(Supernetworks), Dave G.(Supernetworks), 风沐云烟@@binary_fmyy, Jimmy, Mickey Jin@@patch1t, Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Bohdan Stasiuk@@bohdan_stasiuk, Ron Masas(BREAKPOINT), Dominik Rath, Martin Kreichgauer(Google Chrome), Yutong Xiu@@Sou1gh0st, Andr.Ess, Wang Yu(Cyberserval), @@RenwaX23, Syarif Muhammad Sajjad, Andrew James Gonzalez, Guilherme Rambo(Best Buddy Apps), Saagar Jha, Tony Iskow@@Tybbow, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Lucas Leong@@_wmliang_(Trend Micro Zero Day Initiative), Christian Kohlschütter, CVE-2024-8176, Paweł Płatek (Trail(Bits), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), rheza@@ginggilBesel(Palo Alto Networks), Edouard Bochin@@le_douds(Palo Alto Networks), Tao Yan@@Ga1ois(Palo Alto Networks), Nan Wang@@eternalsakura13, Yuhao Hu, Yan Kang, Chenggang Wu, Xiaojie Wei, Ivan Fratric(Google Project Zero), Juergen Schmied(Lynck GmbH), jioundai(360 Vulnerability Research Institute), chen fengjiao(HBC), Dillon Franke(Google Project Zero), Lyutoon(Atredis Partners), YenKoc(Atredis Partners), Dayton Pidhirney(Atredis Partners), Mateusz Krzywicki@@krzywix, Richard Hyunho Im@@richeeta, Noah Gregory (wts.dev), wac, Thibaud Kehler, 秦若涵, 崔志伟, 崔宝江, Deval Jariwala, Dalibor Milanovic, Duy Trần@@khanhduytran0, Lyutoon, YenKoc, Shehab Khan, CertiK@@CertiK, Joseph Ravichandran@@0xjprx(MIT CSAIL), Thomas Völkl@@vollkorntomate, SEEMOO, TU Darmstadt, Kirin@@Pwnrin(Fudan University), Sourabhkumar Mishra, CVE-2025-26465, CVE-2025-26466, Csaba Fitzl@@theevilbit(Kandji), Ryan Dowd@@_rdowd, CVE-2025-24085, Jax Reissner, Richard Hyunho Im with routezero.security@@richeeta, Lehan Dilusha@@zafer, Zhongcheng Li(IES Red Team of ByteDance), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Jeffrey Hofmann, Ian Mckay@@iann0036, Nolan Astrein(Kandji), Stephan Casas, Gergely Kalman@@gergely_kalman, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Pietro Francesco Tirenna(Shielder), Davide Silvetti(Shielder), Abdel Adim Oisfi(Shielder), luckyu@@uuulucky, Rodolphe BRUNETTI@@eisw0lf, Manuel Fernandez (Stackhopper Security), ABC Research s.r.o., Murray Mike, mzzzz__, Ye Zhang@@VAR10CK(Baidu Security), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Kenneth Chew, Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Diamant Osmani & Valdrin Haliti [Kosovë], dbpeppe, Solitechworld, Pwn2car, Alhour@@NSAntoine, Mickey Jin@@patch1t(Kandji), (Kandji), Pedro Tôrres@@t0rr3sp3dr0, CVE-2023-27043, Jaydev Ahire, Yiğit Can YILMAZ@@yilmazcanyigit, Arsenii Kostromin (0x3c3e), Rodolphe Brunetti@@eisw0lf(Lupus Nova), Dolf Hoegaerts, Michiel Devliegere, K宝@@Pwnrin, Tong Liu@@Lyutoon_, 风(binary_fmyy), F00L, zbleet(QI), Cristian Dinca(Computer Science), Romania, 风沐云烟 (binary_fmyy), Kirin, FlowerCode, Zhongquan Li@@Guluisacat, Pedro José Pereira Vieito / pvieito.com)@@pvieito, Alexander Heinrich@@Sn0wfreeze, TU Darmstadt & Mathy Vanhoef@@vanhoefm, Jeroen Robben@@RobbenJeroen, DistriNet, KU Leuven, Florian Draschbacher, Abhay Kailasia@@abhay_kailasia(C), Chi Yuan Chang(ZUSO ART), taikosoup

Affected Software

33 affected componentsFixes available

Apple Safari<18.4

18.4

Apple WatchOS<11.4

11.4

Apple iPadOS<17.7.6

17.7.6

Apple iOS<18.4

18.4

Apple iPadOS<18.4

18.4

Apple tvOS<18.4

18.4

Apple macOS Sequoia<15.4

15.4

Apple WatchOS<11.5

11.5

Apple visionOS<2.5

2.5

Apple Safari<18.4

Apple iPadOS<17.7.6

Apple iPadOS>=18.0<18.4

Apple iPhone OS<18.4

Apple macOS>=15.0<15.4

Apple tvOS<18.4