iOS and iPadOS vulnerabilities

598 known vulnerabilities in iOS and iPadOS from Apple. 587 are rated high or critical, and 61 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-31183Mar 31, 2025AppleEPSS 1.23%

  The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data.

• 9.8 Critical severity

  iOS and iPadOS: Missing Authorization

  CVE-2025-31182Mar 31, 2025AppleEPSS 1.26%

  This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to delete files for which it

• 7.5 High severity

  A validation issue was addressed with improved logic.

  CVE-2025-30471Mar 31, 2025AppleEPSS 1.5%

  A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may be able to cause a den

• 7.8 High severity

  iOS and iPadOS: Improper Preservation of Permissions

  CVE-2025-30456Mar 31, 2025Apple

  A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.

• 9.8 Critical severity

  iOS and iPadOS: Improper Access Control

  CVE-2025-30433Mar 31, 2025AppleEPSS 1.29%

  This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. A shortcut may be able to access files that a

• 9.8 Critical severity

  iOS and iPadOS: Improper Authentication

  CVE-2025-30430Mar 31, 2025AppleEPSS 1.19%

  This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication.

• 9.8 Critical severity

  iOS and iPadOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-30426Mar 31, 2025AppleEPSS 1.23%

  This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to enumerate a user's installed apps.

• 9.8 Critical severity

  Safari: Uncontrolled Resource Consumption

  CVE-2025-24264Mar 31, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2025-24257Mar 31, 2025Apple

  An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected system termination or write kernel memory.

• 7.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2025-24243Mar 31, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing a maliciously crafted file m

• 9.8 Critical severity

  iOS and iPadOS: Incorrect Default Permissions

  CVE-2025-24238Mar 31, 2025AppleEPSS 1.14%

  A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to gain elevated privileges.

• 9.8 Critical severity

  iOS and iPadOS: Buffer Copy without Checking Size of Input

  CVE-2025-24237Mar 31, 2025AppleEPSS 1.64%

  A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected sys

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Read

  CVE-2025-24230Mar 31, 2025AppleEPSS 1.92%

  An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. Playing a malicious

• 7.5 High severity

  iOS and iPadOS: Incorrect Authorization

  CVE-2025-24221Mar 31, 2025Apple

  This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychain data may be accessible from an iOS backup.

• 7.8 High severity

  Safari: Access of Resource Using Incompatible Type

  CVE-2025-24213Mar 31, 2025Apple

  This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A type confusion issue could lead to memory corruption.

• 9.8 Critical severity

  iOS and iPadOS: Uncontrolled Resource Consumption

  CVE-2025-24211Mar 31, 2025AppleEPSS 1.92%

  This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. Processing a maliciously crafted video file may lead

• 7.0 High severity

  Safari: Buffer Copy without Checking Size of Input

  CVE-2025-24209Mar 31, 2025Apple

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected

• 9.8 Critical severity

  iOS and iPadOS: Uncontrolled Resource Consumption

  CVE-2025-24190Mar 31, 2025AppleEPSS 1.92%

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing a maliciously crafted video

• 8.1 High severity

  Safari: URL Redirection to Untrusted Site

  CVE-2025-24180Mar 31, 2025AppleEPSS 1.04%

  The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares

• 7.8 High severity

  iOS and iPadOS: Improper Access Control

  CVE-2025-24173Mar 31, 2025Apple

  This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out o

• 7.6 High severity

  iOS and iPadOS: Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-24095Mar 31, 2025Apple

  This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privacy preferences.

• 7.5 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-54551Mar 21, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service.

• 8.8 High severity

  iOS and iPadOS: Unrestricted Upload of File with Dangerous Type

  CVE-2024-54525Mar 17, 2025Apple

  A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Restoring a maliciously crafted backup file may lead to modification of protected system files.

• 7.3 High severity

  iOS and iPadOS: Cleartext Transmission of Sensitive Information

  CVE-2024-44276Mar 17, 2025Apple

  This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged network position may be able to leak sensitive information.

• 10.0 Critical severity

  Apple Multiple Products WebKit Out-of-Bounds Write Exploited

  CVE-2025-24201Mar 11, 2025AppleEPSS 3.85%

  An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3

• 7.8 High severity

  macOS: Double Free

  CVE-2022-43454Mar 10, 2025Apple

  A double free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.

• 7.5 High severity

  iOS and iPadOS: Uncontrolled Resource Consumption

  CVE-2024-44227Mar 10, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected system termination or corrupt kernel memory.

• 6.1 Medium severity

  Apple iOS and iPadOS Incorrect Authorization Exploited

  CVE-2025-24200Feb 10, 2025AppleEPSS 4.46%

  An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked

• 8.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2024-27859Feb 10, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to arbitrary code execution.

• 7.5 High severity

  iOS and iPadOS: NULL Pointer Dereference

  CVE-2025-24177Jan 27, 2025Apple

  A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker on the local network may be able to cause a deni

• 7.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2025-24159Jan 27, 2025Apple

  A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to execute arbitrary code with kernel privi

• 9.1 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2025-24154Jan 27, 2025AppleEPSS 1.16%

  An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, visionOS 2.3. An attacker may be able to cause unexpected system termination or

• 8.8 High severity

  Safari: Improper Neutralization of Special Elements used in a Command

  CVE-2025-24150Jan 27, 2025AppleEPSS 2.94%

  A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from Web Inspector may lead to command injection.

• 8.0 High severity

  iOS and iPadOS: Access of Resource Using Incompatible Type

  CVE-2025-24137Jan 27, 2025Apple

  A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3. An attacker on the local network may corrupt process memory.

• 7.5 High severity

  iOS and iPadOS: Access of Resource Using Incompatible Type

  CVE-2025-24129Jan 27, 2025AppleEPSS 1.31%

  A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may cause an unexpected app ter

• 7.3 High severity

  iOS and iPadOS: Uncontrolled Resource Consumption

  CVE-2025-24126Jan 27, 2025AppleEPSS 1.36%

  An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to corrupt process memory.

• 7.8 High severity

  iOS and iPadOS: Incorrect Default Permissions

  CVE-2025-24107Jan 27, 2025Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3. A malicious app may be able to gain root privileges.

• 10.0 Critical severity

  Apple Multiple Products Use-After-Free Exploited

  CVE-2025-24085Jan 27, 2025AppleEPSS 17.4%

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application

• 8.8 High severity

  Safari: Out-of-bounds Write

  CVE-2024-54543Jan 27, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corrupt

• 9.1 Critical severity

  Safari: Missing Authorization

  CVE-2024-54542Jan 27, 2025Apple

  An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS 11.2. Private Browsing tabs may be accessed without authentication.