CVE-2025-24158: Apple Safari DOS Vulnerability

CVE-2025-24158 Overview

CVE-2025-24158 is a memory handling vulnerability affecting Apple's WebKit browser engine across multiple Apple platforms. The vulnerability exists in Safari and the WebKit framework used by iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. When processing maliciously crafted web content, the vulnerability can be exploited to cause a denial-of-service condition, making affected applications or systems unresponsive.

Critical Impact

Attackers can remotely trigger a denial-of-service condition by delivering malicious web content to users, potentially disrupting access to web services and applications across Apple's entire ecosystem of devices.

Affected Products

• Apple Safari (versions prior to 18.3)
• Apple iOS and iPadOS (versions prior to 18.3)
• Apple macOS Sequoia (versions prior to 15.3)
• Apple watchOS (versions prior to 11.3)
• Apple tvOS (versions prior to 18.3)
• Apple visionOS (versions prior to 2.3)

Discovery Timeline

• 2025-01-27 - CVE-2025-24158 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-24158

Vulnerability Analysis

This vulnerability stems from improper memory handling within Apple's WebKit rendering engine. WebKit is the core browser engine powering Safari and providing web content rendering capabilities across all Apple platforms. The flaw allows attackers to craft specific web content that, when processed by the vulnerable WebKit component, triggers memory corruption leading to application crashes or system instability.

The vulnerability requires user interaction—a victim must navigate to or load malicious web content for the attack to succeed. This could occur through phishing links, malicious advertisements, compromised websites, or embedded content in emails and messages. Once triggered, the attack causes a denial-of-service condition that can render the browser or web-enabled application unresponsive.

Root Cause

The root cause lies in improper memory handling during web content processing. When WebKit parses and renders certain malformed or specially crafted content, it fails to properly manage memory allocations and deallocations. This can result in memory corruption that crashes the rendering process or the entire application. Apple addressed this issue by implementing improved memory handling mechanisms in the patched versions.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver malicious web content to the target. This can be accomplished through various methods:

• Hosting malicious content on attacker-controlled websites
• Injecting malicious content into legitimate websites via cross-site scripting
• Distributing links through phishing campaigns
• Embedding malicious content in web-based advertisements
• Including malicious content in HTML emails

The vulnerability does not require authentication or special privileges to exploit, but it does require user interaction to load the malicious content in a vulnerable browser or application.

Detection Methods for CVE-2025-24158

Indicators of Compromise

• Unexpected Safari or WebKit-based application crashes when visiting specific websites
• Repeated denial-of-service events affecting web browsing functionality
• Crash reports indicating memory-related issues in WebKit processes
• Unusual network traffic patterns to newly registered or suspicious domains followed by application crashes

Detection Strategies

• Monitor for WebKit process crashes across managed Apple devices using endpoint detection tools
• Implement web filtering to block access to known malicious domains serving exploit content
• Analyze crash reports from managed devices for patterns consistent with memory corruption in WebKit
• Deploy network-based detection for suspicious web content delivery attempts

Monitoring Recommendations

• Enable crash reporting and centralized log collection for all managed Apple devices
• Monitor for unusual patterns of browser crashes across the organization
• Implement SentinelOne Singularity Platform for real-time detection of exploitation attempts
• Track security advisories from Apple and WebKit security mailing lists for related vulnerabilities

How to Mitigate CVE-2025-24158

Immediate Actions Required

• Update Safari to version 18.3 or later on all affected systems
• Update iOS and iPadOS devices to version 18.3 or later
• Update macOS Sequoia systems to version 15.3 or later
• Update watchOS to version 11.3, tvOS to version 18.3, and visionOS to version 2.3
• Enable automatic updates to ensure timely deployment of future security patches

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. Detailed patch information is available in the following security advisories:

• Apple Security Advisory #122066
• Apple Security Advisory #122068
• Apple Security Advisory #122071
• Apple Security Advisory #122072
• Apple Security Advisory #122073
• Apple Security Advisory #122074

Additionally, Debian has issued an advisory for WebKit-based packages: Debian LTS Announcement #14

Workarounds

• Implement web content filtering to restrict access to untrusted or suspicious websites
• Use browser extensions or security tools that block malicious web content
• Educate users about the risks of clicking unknown links or visiting untrusted websites
• Consider disabling JavaScript on untrusted sites as a temporary measure (may impact functionality)
• Deploy network-level protection to filter potentially malicious web content before it reaches endpoints

# Check current Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Check current macOS version
sw_vers -productVersion

# Enable automatic updates on macOS
sudo softwareupdate --schedule on