CVE-2025-24117 Overview
CVE-2025-24117 is an information disclosure vulnerability affecting multiple Apple operating systems. The flaw allows a local application to fingerprint the user through insufficient redaction of sensitive information. Apple addressed the issue with improved redaction across iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability is categorized under [CWE-922] Insecure Storage of Sensitive Information.
Critical Impact
A locally installed application can extract identifying data sufficient to fingerprint the device user, undermining privacy boundaries between apps on the device.
Affected Products
- Apple iOS prior to 18.3 and iPadOS prior to 18.3 (also iPadOS 17.7.4)
- Apple macOS Sequoia prior to 15.3
- Apple visionOS prior to 2.3 and watchOS prior to 11.3
Discovery Timeline
- 2025-01-27 - CVE CVE-2025-24117 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24117
Vulnerability Analysis
The vulnerability stems from insufficient redaction of sensitive information exposed to installed applications. Apple's platforms sandbox third-party applications and are expected to withhold identifiers that could be correlated across apps or sessions. In affected versions, redaction of certain data was incomplete, allowing a locally running app to derive persistent user or device identifiers.
An app leveraging this flaw can build a stable fingerprint of the user across app launches or between different applications on the same device. This defeats privacy controls that Apple's platform enforces against cross-app tracking. Apple's advisory attributes the fix to "improved redaction of sensitive information" without disclosing the specific data channel.
Root Cause
The root cause maps to [CWE-922] Insecure Storage of Sensitive Information. System-exposed data intended to be sanitized before delivery to sandboxed apps retained residual identifiers. Because the leaked material persisted across contexts, it functioned as a stable fingerprint.
Attack Vector
Exploitation requires an application to be installed and executed on the target device. The attack requires user interaction to install and run the malicious app. No elevated privileges are needed, and the attack does not require network access. Apple has not published proof-of-concept code, and no public exploit is available.
Technical details are not disclosed in the vendor advisories. See Apple's advisories for platform-specific notes: Apple Support Article #122066, Apple Support Article #122067, Apple Support Article #122068, Apple Support Article #122071, and Apple Support Article #122073.
Detection Methods for CVE-2025-24117
Indicators of Compromise
- No public indicators of compromise have been published for this vulnerability.
- Apple has not disclosed telemetry signatures tied to abuse of the redaction weakness.
Detection Strategies
- Inventory Apple endpoints and compare installed OS build numbers against the fixed versions (iOS/iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3).
- Review third-party mobile applications for excessive access to system APIs that expose identifiers, and flag apps requesting broad diagnostic entitlements.
- Use mobile threat defense or MDM posture checks to identify devices running vulnerable OS versions.
Monitoring Recommendations
- Enforce OS version compliance policies through Mobile Device Management (MDM) and alert on devices below the patched builds.
- Monitor enterprise app catalogs for apps that read device telemetry inconsistent with their stated purpose.
- Track Apple's security advisory feed for follow-on disclosures related to fingerprinting fixes.
How to Mitigate CVE-2025-24117
Immediate Actions Required
- Upgrade to iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, or watchOS 11.3 as applicable.
- Push the update via MDM to managed fleets and verify installation through compliance reporting.
- Restrict installation of unvetted third-party applications on managed devices until patched.
Patch Information
Apple has released fixes across affected platforms. Refer to Apple Support Article #122066, Apple Support Article #122067, Apple Support Article #122068, Apple Support Article #122071, and Apple Support Article #122073 for exact build numbers and installation guidance.
Workarounds
- No vendor-provided workaround exists; patching to the fixed OS version is the only supported remediation.
- Reduce exposure by limiting side-loaded or enterprise-signed applications and enforcing app vetting for privacy-sensitive entitlements.
- Apply MDM restrictions that prevent installation of applications from untrusted developer accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.