CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write

Exploited in the wild Critical 10.0 Published 11 Mar 2025 Updated 2 Apr 2026

Attackers can execute arbitrary code and escape the Web Content sandbox via malicious web content in Apple Safari and related operating systems.

Exploited in the wild: Since 13 Mar 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-24201?

CVE-2025-24201 is a critical memory corruption vulnerability in Apple Ipados, published on 11 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Weakness: CWE-787

Which versions are affected by CVE-2025-24201?

It affects 7 products.

Linux distribution packages (40)

`webkit2gtk3` AlmaLinux:8	All versions	`2.46.6-2.el8_10`
`webkit2gtk3-devel` AlmaLinux:8	All versions	`2.46.6-2.el8_10`
`webkit2gtk3-jsc` AlmaLinux:8	All versions	`2.46.6-2.el8_10`
`webkit2gtk3-jsc-devel` AlmaLinux:8	All versions	`2.46.6-2.el8_10`
`webkit2gtk3` AlmaLinux:9	All versions	`2.46.6-2.el9_5`
`webkit2gtk3-devel` AlmaLinux:9	All versions	`2.46.6-2.el9_5`
`webkit2gtk3-jsc` AlmaLinux:9	All versions	`2.46.6-2.el9_5`
`webkit2gtk3-jsc-devel` AlmaLinux:9	All versions	`2.46.6-2.el9_5`
`webkit2gtk3` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-jsc` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-jsc-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-jsc-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3-jsc-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.46.6-2.el8_10`
`webkit2gtk3` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-devel-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-jsc` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-jsc-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-jsc-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3-jsc-devel-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.46.6-2.el9_5`
`webkit2gtk3` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-debugsource` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-devel` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-devel-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-jsc` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-jsc-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-jsc-devel` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3-jsc-devel-debuginfo` Red Hat:rhel_aus:8.2::appstream	All versions	`0:2.46.6-2.el8_2`
`webkit2gtk3` Red Hat:rhel_aus:8.4::appstream	All versions	`0:2.46.6-2.el8_4`
`webkit2gtk3-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`0:2.46.6-2.el8_4`
`webkit2gtk3-debugsource` Red Hat:rhel_aus:8.4::appstream	All versions	`0:2.46.6-2.el8_4`
`webkit2gtk3-devel` Red Hat:rhel_aus:8.4::appstream	All versions	`0:2.46.6-2.el8_4`
`webkit2gtk3-devel-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`0:2.46.6-2.el8_4`

Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Safari, Apple Visionos, Apple Watchos and 1 more.

How do I fix CVE-2025-24201?

Apply the vendor's patch. US federal agencies must fix it by 3 Apr 2025.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-24201 being exploited?

Yes. Attackers have exploited CVE-2025-24201 in the wild since at least 13 Mar 2025.

Public exploit code: 2 proofs of concept on GitHub.

All Apple Ipados vulnerabilities

Sources

Also known as ALSA-2025:2863, ALSA-2025:2864, CLSA-2025-1748626479, DEBIAN-CVE-2025-24201, GHSA-2j99-5q75-3f57, RHSA-2025:2863 and 14 more.