CVE-2025-24201

Description

CVE-2025-24201 is an out-of-bounds write vulnerability in WebKit, Apple's browser engine. Maliciously crafted web content could exploit this issue to break out of the Web Content sandbox, potentially leading to arbitrary code execution. Apple addressed this vulnerability by implementing improved checks to prevent unauthorized actions in the affected systems. According to Kandji's analysis, this vulnerability exemplifies the challenges posed by shared codebases across different platforms. The widespread use of WebKit means that a single vulnerability can have far-reaching implications beyond just Apple's ecosystem.

Impact

Exploitation of this vulnerability could allow attackers to execute arbitrary code on the affected devices, leading to potential data breaches, unauthorized access, or further compromise of the system. Apple has acknowledged reports that this issue may have been exploited in extremely sophisticated attacks against specific targeted individuals on versions of iOS before iOS 17.2. The severity of this issue has been assessed as follows: