CVE-2025-24213

This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption.

ajajfxhj discovered that processing web content may lead to a denial-of-service. Muhammad Zaid Ghifari and Kalimantan Utara discovered that loading a malicious iframe may lead to a cross-site scripting attack. Francisco Alonso and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. The Google V8 Security Team discovered that a type confusion issue could lead to memory corruption. Note that this CVE is fixed only on ARM architectures. x86_64 is not vulnerable, x86 is not vulnerable when the SSE2 instruction set is enabled; but other architectures remain vulnerable. Paul Bakker discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. Gary Kwong and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected crash. rheza discovered that processing maliciously crafted web content may lead to an unexpected crash.