CVE-2025-24264

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

ajajfxhj discovered that processing web content may lead to a denial-of-service. Muhammad Zaid Ghifari and Kalimantan Utara discovered that loading a malicious iframe may lead to a cross-site scripting attack. Francisco Alonso and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. The Google V8 Security Team discovered that a type confusion issue could lead to memory corruption. Note that this CVE is fixed only on ARM architectures. x86_64 is not vulnerable, x86 is not vulnerable when the SSE2 instruction set is enabled; but other architectures remain vulnerable. Paul Bakker discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. Gary Kwong and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected crash. rheza discovered that processing maliciously crafted web content may lead to an unexpected crash.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2025-01-17 CVE Reserved
2025-03-31 CVE Published
2025-04-01 CVE Updated
2025-05-02 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-400: Uncontrolled Resource Consumption

CAPEC

References (8)

URL	Tag	Source
https://support.apple.com/en-us/122371
https://support.apple.com/en-us/122372
https://support.apple.com/en-us/122373
https://support.apple.com/en-us/122377
https://support.apple.com/en-us/122378
https://support.apple.com/en-us/122379

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2025-24264	2024-11-14
https://bugzilla.redhat.com/show_bug.cgi?id=2357918	2024-11-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apple Search vendor "Apple"		Ios Search vendor "Apple" for product "Ios"				*		-		Affected
Apple Search vendor "Apple"		Ipados Search vendor "Apple" for product "Ipados"				*		-		Affected
Apple Search vendor "Apple"		Macos Search vendor "Apple" for product "Macos"				*		-		Affected
Apple Search vendor "Apple"		Safari Search vendor "Apple" for product "Safari"				*		-		Affected
Apple Search vendor "Apple"		Visionos Search vendor "Apple" for product "Visionos"				*		-		Affected
Apple Search vendor "Apple"		Tvos Search vendor "Apple" for product "Tvos"				*		-		Affected