Paper/Archive/CVE-2025-24167

CVE-2025-24167

Apple Safari — This issue was addressed through improved state management.

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.9.609 × 2012.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated.

Affected

ProductAffectedFixed inSource

Safari< 18.418.4CNA

iOS and iPadOS< 18.418.4CNA

macOS< 15.415.4CNA

watchOS< 11.411.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/122371 refsupport.apple.com/en-us/122373 refsupport.apple.com/en-us/122376 refsupport.apple.com/en-us/122379 refseclists.org/fulldisclosure/2025/Apr/13 refseclists.org/fulldisclosure/2025/Apr/8 refseclists.org/fulldisclosure/2025/Apr/4 refseclists.org/fulldisclosure/2025/Apr/2