macOS vulnerabilities

1,185 known vulnerabilities in macOS from Apple. 1,173 are rated high or critical, and 78 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2024-27859Feb 10, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to arbitrary code execution.

• 7.5 High severity

  iOS and iPadOS: NULL Pointer Dereference

  CVE-2025-24177Jan 27, 2025Apple

  A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker on the local network may be able to cause a deni

• 7.1 High severity

  macOS: Incorrect Default Permissions

  CVE-2025-24176Jan 27, 2025Apple

  A permissions issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be able to elevate their privileges.

• 7.7 High severity

  macOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-24174Jan 27, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences.

• 7.5 High severity

  Safari: Insertion of Sensitive Information into Log File

  CVE-2025-24169Jan 27, 2025Apple

  A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.

• 7.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2025-24159Jan 27, 2025Apple

  A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to execute arbitrary code with kernel privi

• 7.8 High severity

  macOS: Integer Overflow or Wraparound

  CVE-2025-24156Jan 27, 2025Apple

  An integer overflow was addressed through improved input validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to elevate privileges.

• 9.1 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2025-24154Jan 27, 2025AppleEPSS 1.16%

  An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, visionOS 2.3. An attacker may be able to cause unexpected system termination or

• 8.8 High severity

  Safari: Improper Neutralization of Special Elements used in a Command

  CVE-2025-24150Jan 27, 2025AppleEPSS 2.94%

  A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from Web Inspector may lead to command injection.

• 9.8 Critical severity

  macOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-24146Jan 27, 2025Apple

  This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. Deleting a conversation in Messages may expose user contact information in system logging.

• 8.0 High severity

  iOS and iPadOS: Access of Resource Using Incompatible Type

  CVE-2025-24137Jan 27, 2025Apple

  A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3. An attacker on the local network may corrupt process memory.

• 7.5 High severity

  iOS and iPadOS: Access of Resource Using Incompatible Type

  CVE-2025-24129Jan 27, 2025AppleEPSS 1.31%

  A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may cause an unexpected app ter

• 7.3 High severity

  iOS and iPadOS: Uncontrolled Resource Consumption

  CVE-2025-24126Jan 27, 2025AppleEPSS 1.36%

  An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on the local network may be able to corrupt process memory.

• 7.5 High severity

  macOS: Missing Release of Resource after Effective Lifetime

  CVE-2025-24120Jan 27, 2025Apple

  This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An attacker may be able to cause unexpected app termination.

• 7.1 High severity

  iPadOS: Out-of-bounds Write

  CVE-2025-24118Jan 27, 2025AppleEPSS 3.75%

  The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to cause unexpected system termination or write kernel memory.

• 7.8 High severity

  iOS and iPadOS: Incorrect Default Permissions

  CVE-2025-24107Jan 27, 2025Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3. A malicious app may be able to gain root privileges.

• 9.8 Critical severity

  iPadOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-24102Jan 27, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to determine a user’s current location.

• 9.8 Critical severity

  macOS: Incorrect Default Permissions

  CVE-2025-24093Jan 27, 2025Apple

  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access removable volumes without user consent.

• 10.0 Critical severity

  Apple Multiple Products Use-After-Free Exploited

  CVE-2025-24085Jan 27, 2025AppleEPSS 17.4%

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application

• 7.5 High severity

  macOS: Improper Preservation of Permissions

  CVE-2024-54557Jan 27, 2025Apple

  A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may gain access to protected parts of the file system.

• 8.8 High severity

  Safari: Out-of-bounds Write

  CVE-2024-54543Jan 27, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corrupt

• 9.1 Critical severity

  Safari: Missing Authorization

  CVE-2024-54542Jan 27, 2025Apple

  An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS 11.2. Private Browsing tabs may be accessed without authentication.

• 9.1 Critical severity

  iOS and iPadOS: Incorrect Authorization

  CVE-2024-54530Jan 27, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, watchOS 11.2. Password autofill may fill in passwords after failing authentication.

• 7.8 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2024-54522Jan 27, 2025Apple

  The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may be able to corrupt coprocessor memory.

• 7.8 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2024-54517Jan 27, 2025Apple

  The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may be able to corrupt coprocessor memory.

• 7.8 High severity

  macOS: Out-of-bounds Write

  CVE-2024-54509Jan 27, 2025Apple

  An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Sonoma 14.7.3. An app may be able to cause unexpected system termination or write kernel memory.

• 8.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2024-54499Jan 27, 2025Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted image may lead to arbitrary code execution.

• 7.8 High severity

  iOS and iPadOS: Incorrect Authorization

  CVE-2024-40771Jan 15, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to e

• 7.8 High severity

  Safari: Improper Control of Generation of Code

  CVE-2024-27856Jan 15, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbi

• 7.5 High severity

  iOS and iPadOS: Allocation of Resources Without Limits or Throttling

  CVE-2024-54538Dec 20, 2024Apple

  A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A remot

• 9.8 Critical severity

  Safari: Out-of-bounds Write

  CVE-2024-54534Dec 12, 2024AppleEPSS 1.04%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corrupt

• 7.8 High severity

  macOS: Improper Control of Generation of Code

  CVE-2024-54529Dec 12, 2024Apple

  A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

• 7.8 High severity

  macOS: Improper Preservation of Permissions

  CVE-2024-54515Dec 12, 2024Apple

  A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges.

• 7.5 High severity

  Safari: Out-of-bounds Read

  CVE-2024-54508Dec 12, 2024Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected

• 9.8 Critical severity

  macOS: Out-of-bounds Read

  CVE-2024-54506Dec 12, 2024Apple

  An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.2. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.

• 8.8 High severity

  Safari: Access of Resource Using Incompatible Type

  CVE-2024-54505Dec 12, 2024AppleEPSS 1.07%

  A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to m

• 7.8 High severity

  macOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-54489Dec 12, 2024Apple

  A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a mount command may unexpectedly execute arbitrary code.

• 7.1 High severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2024-44245Dec 12, 2024Apple

  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, visionOS 2.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

• 9.8 Critical severity

  iOS and iPadOS: Out-of-bounds Write

  CVE-2024-44242Dec 12, 2024Apple

  The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.

• 9.8 Critical severity

  iOS and iPadOS: Allocation of Resources Without Limits or Throttling

  CVE-2024-44241Dec 12, 2024Apple

  The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.