CVE-2025-24091: Apple iPadOS DoS Vulnerability

CVE-2025-24091 Overview

CVE-2025-24091 is an authentication weakness in Apple iOS and iPadOS that allows a local application to impersonate system notifications. The flaw stems from missing entitlement restrictions on sensitive notification types, enabling an unprivileged app to post notifications that appear to originate from the operating system. Apple addressed the issue by requiring restricted entitlements for sensitive notifications. According to the advisory, an exploiting app may also trigger a denial-of-service condition on the device. The vulnerability is tracked under [CWE-290: Authentication Bypass by Spoofing].

Critical Impact
A malicious application installed on an iPhone or iPad can spoof legitimate system notifications and cause denial-of-service, undermining user trust in OS-level prompts and potentially aiding phishing or social engineering.

Affected Products

Apple iOS prior to 18.3
Apple iPadOS prior to 18.3
Apple iPadOS prior to 17.7.3

Discovery Timeline

2025-04-30 - CVE-2025-24091 published to NVD
2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-24091

Vulnerability Analysis

The vulnerability resides in the notification subsystem of iOS and iPadOS. Sensitive notification categories were not gated behind restricted entitlements, allowing arbitrary apps to emit notifications indistinguishable from those generated by core system services. An attacker leveraging this weakness can present spoofed alerts that mimic Apple's own prompts, such as security warnings or system messages. The same code path can also be abused to flood the notification subsystem, producing a denial-of-service condition that disrupts normal device usage. EPSS data lists this issue at 0.259% with a percentile of 49.3, reflecting low observed exploitation interest.

Root Cause

The root cause is missing entitlement enforcement on sensitive notifications. Apple's notification APIs did not verify that the calling app held the privileged entitlements required to post system-level notification types. This permitted any sandboxed application to forge notifications that the user would attribute to the operating system, satisfying the conditions of [CWE-290].

Attack Vector

Exploitation requires local code execution in the form of an installed application and user interaction with the spoofed notification. The attack vector is local, meaning the malicious payload must be delivered through the App Store or an enterprise distribution channel. Once installed, the app calls the notification APIs without holding the required entitlement and emits forged content. The resulting impact targets availability and trust rather than confidentiality.

No public proof-of-concept code or exploit is currently available for CVE-2025-24091. See the Apple Security Advisory #121838 and Apple Security Advisory #122066 for vendor details.

Detection Methods for CVE-2025-24091

Indicators of Compromise

Unexpected system-style notifications appearing without a corresponding settings change or OS event.
Sudden bursts of notifications that degrade device responsiveness, consistent with the denial-of-service impact.
Recently installed third-party apps that request notification permissions and exhibit anomalous foreground or background activity.

Detection Strategies

Inventory managed iOS and iPadOS fleets through Mobile Device Management (MDM) and flag devices running versions older than iOS 18.3, iPadOS 18.3, or iPadOS 17.7.3.
Review App Store and enterprise-signed app installations for apps that post notifications matching system UI patterns.
Correlate user-reported phishing prompts with installed application telemetry to identify candidate impersonating apps.

Monitoring Recommendations

Enable crash and diagnostic log collection via MDM to capture notification-related anomalies and resource exhaustion events.
Track OS version compliance continuously and alert on devices that fall behind the patched baseline.
Educate users to report unexpected security prompts and route those reports to the security team for triage.

How to Mitigate CVE-2025-24091

Immediate Actions Required

Update all iPhones to iOS 18.3 or later.
Update all iPads to iPadOS 18.3, or iPadOS 17.7.3 on devices that remain on the iPadOS 17 branch.
Enforce minimum OS version requirements through MDM policies and block noncompliant devices from sensitive corporate resources.
Remove untrusted third-party applications and restrict installation to vetted sources.

Patch Information

Apple fixed CVE-2025-24091 by requiring restricted entitlements for sensitive notifications. The fix is delivered in iOS 18.3, iPadOS 18.3, and iPadOS 17.7.3. Refer to Apple Security Advisory #121838 and Apple Security Advisory #122066 for the full list of addressed issues and supported device matrices.

Workarounds

No vendor-supplied workaround exists; applying the OS update is the only complete remediation.
As an interim measure, limit installation of non-essential applications and review notification permissions in Settings > Notifications.
Instruct users to treat unsolicited system prompts with skepticism and to verify sensitive actions through trusted settings paths rather than tapping notifications.

bash

# MDM compliance check example (pseudocode)
# Flag devices below the patched OS baseline
if device.os == "iOS" and device.version < "18.3": mark_noncompliant
if device.os == "iPadOS" and device.version < "17.7.3": mark_noncompliant