CVE-2025-24159: Apple iPadOS RCE Vulnerability

CVE-2025-24159 Overview

CVE-2025-24159 is a validation flaw across multiple Apple operating systems that allows a local application to execute arbitrary code with kernel privileges. Apple addressed the issue with improved validation logic and shipped fixes in iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. The weakness maps to [CWE-94] (Improper Control of Generation of Code) and carries a CVSS 3.1 base score of 7.8. Successful exploitation gives an attacker full kernel-level control on the affected device.

Critical Impact

A locally installed application can escape user-mode constraints and execute arbitrary code with kernel privileges, leading to complete device compromise.

Affected Products

• Apple iOS and iPadOS prior to 18.3 (and iPadOS 17 prior to 17.7.4)
• Apple macOS Sequoia prior to 15.3 and macOS Sonoma prior to 14.7.3
• Apple tvOS prior to 18.3, visionOS prior to 2.3, and watchOS prior to 11.3

Discovery Timeline

• 2025-01-27 - CVE-2025-24159 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2025-24159

Vulnerability Analysis

The issue is a validation weakness in an Apple operating system component that processes input destined for the kernel. According to Apple's advisories, the flaw was resolved with improved logic, indicating that previously accepted inputs or state transitions bypassed required checks. An application running locally on the device can leverage the weakness to execute arbitrary code with kernel privileges. The vulnerability requires user interaction, which in practice typically means a user installing or running a malicious application. Once executed in kernel context, an attacker can disable security mitigations, persist across reboots, and access protected user data on iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro hardware.

Root Cause

Apple classified the defect as a validation issue addressed with improved logic, and NVD assigned [CWE-94] (Improper Control of Generation of Code). The combination suggests insufficient validation of attacker-influenced data that ultimately reaches a code-generating or code-executing path inside the kernel. Apple has not disclosed the specific affected component or function names.

Attack Vector

The attack vector is local, with low attack complexity and no privileges required, but user interaction is needed. A malicious or compromised application installed on the device invokes the vulnerable interface and supplies crafted input. The kernel processes the input without adequate validation, enabling the attacker to gain code execution in ring 0. No network exposure is required, and no authentication is needed beyond what is necessary to run an app locally.

No public proof-of-concept code has been released. Apple has not published implementation details, and no entries are listed in Exploit-DB. Readers seeking additional context can review the Apple Support documentation for iOS 18.3 and the Full Disclosure mailing list archive entries from January 2025.

Detection Methods for CVE-2025-24159

Indicators of Compromise

• No public indicators of compromise have been published for CVE-2025-24159, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
• Unexpected installation of unsigned or sideloaded applications, particularly via developer or enterprise provisioning profiles, can indicate the staging step required for local exploitation.
• Kernel panics, unexplained reboots, or device instability following the launch of a recently installed application warrant deeper review.

Detection Strategies

• Inventory Apple devices and flag any endpoint running a build older than iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, or watchOS 11.3.
• On macOS, monitor for unsigned binaries, suspicious kext or system extension loads, and tampering with System Integrity Protection.
• Collect MDM compliance telemetry to detect devices that fail to apply Apple security updates within the organization's patch SLA.

Monitoring Recommendations

• Forward macOS Endpoint Security and Unified Log events to a central analytics platform to correlate process executions with system stability events.
• Track installation events from non-App Store sources and configuration profile changes on iOS and iPadOS via MDM.
• Alert on repeated application crashes that coincide with kernel diagnostic reports submitted by the device.

How to Mitigate CVE-2025-24159

Immediate Actions Required

• Update all Apple devices to the fixed releases: iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3 or later.
• Push the updates through MDM with an enforced deadline and report on compliance for managed fleets.
• Audit installed applications and remove untrusted or unnecessary software, especially apps installed outside the App Store.

Patch Information

Apple released coordinated security updates on January 27, 2025 across its product line. Refer to the vendor advisories for build numbers and component-level notes: Apple Support #122066, #122067, #122068, #122069, #122071, #122072, and #122073.

Workarounds

• No vendor-supplied workaround exists; applying the security update is the only supported remediation.
• Restrict installation sources by enforcing App Store-only policies and disabling sideloading or developer mode where it is not required.
• Apply Lockdown Mode for high-risk users on iOS, iPadOS, and macOS to reduce the available local attack surface.

# Verify that a macOS endpoint is on a patched build
sw_vers
# Expected: ProductVersion 15.3 (Sequoia) or 14.7.3 (Sonoma) or later

# Trigger and install pending Apple software updates
sudo softwareupdate --install --all --restart