CVE-2025-24202: Apple iPadOS Information Disclosure Flaw

CVE-2025-24202 Overview

CVE-2025-24202 is an information disclosure vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw stems from insufficient data redaction in system logs, allowing an application to access sensitive user data that should have been sanitized before being written to log output. Apple addressed the issue by improving data redaction in iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4. The vulnerability is categorized under [CWE-284] Improper Access Control and requires local access with user interaction to exploit.

Critical Impact
An installed application can retrieve sensitive user data from unredacted log entries without triggering standard permission prompts.

Affected Products

Apple iOS (versions prior to 18.4)
Apple iPadOS (versions prior to 18.4)
Apple macOS Sequoia (versions prior to 15.4)

Discovery Timeline

2025-03-31 - CVE-2025-24202 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24202

Vulnerability Analysis

CVE-2025-24202 is a local information disclosure flaw caused by improper redaction of sensitive fields written to system logs. Applications with legitimate log-reading capabilities on the device can parse these entries to extract user data that should have been masked. The vulnerability does not require elevated privileges but does require user interaction, such as installing or launching an app that queries log content. Because the flaw exists in system-level logging behavior, the impacted data may include information originating from multiple applications or OS components.

Root Cause

The root cause is insufficient sanitization of sensitive values before they are emitted to logging facilities on iOS, iPadOS, and macOS. Apple's advisory describes the fix as "improved data redaction," indicating that specific data fields were being logged in cleartext or without adequate masking. This class of issue maps to [CWE-284] Improper Access Control, since log storage was accessible to processes that should not have received the sensitive content.

Attack Vector

Exploitation requires a local vector. A malicious or curious application installed on the device reads system log entries and extracts unredacted sensitive values. No network access is required, and the attacker gains confidentiality impact only, with no integrity or availability effect. Public exploit code is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to Apple Support Article #122371 and Apple Support Article #122373 for vendor-supplied technical context.

Detection Methods for CVE-2025-24202

Indicators of Compromise

Applications that read from unified logging facilities (os_log, OSLogStore) shortly after installation or launch.
Unexpected log-export or diagnostic profile installations on managed devices.
Third-party apps requesting the com.apple.developer.diagnostics-log-collection entitlement without a clear business purpose.

Detection Strategies

Inventory apps on managed iOS, iPadOS, and macOS endpoints and flag any accessing log stores or sysdiagnose bundles.
Compare installed OS build numbers against the fixed versions (iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4) using MDM compliance reporting.
Review App Store and enterprise distribution reviews for apps requesting diagnostic entitlements.

Monitoring Recommendations

Ingest MDM device inventory and OS version telemetry into a centralized data lake for ongoing patch-state monitoring.
Alert when sysdiagnose or log archives are exfiltrated from a device to an unknown destination.
Track application behaviors that combine log access with network egress after a short dwell time.

How to Mitigate CVE-2025-24202

Immediate Actions Required

Update all iPhones to iOS 18.4 or later and all iPads to iPadOS 18.4 or later.
Update all Macs running Sequoia to macOS Sequoia 15.4 or later.
Audit installed applications on managed fleets for unexpected use of diagnostic or log-reading APIs.
Enforce update compliance through MDM policies and block non-compliant devices from sensitive resources.

Patch Information

Apple released fixes in iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4. Full remediation details are available in Apple Support Article #122371 and Apple Support Article #122373. Additional third-party disclosures are indexed at Full Disclosure April 2025 #4 and Full Disclosure April 2025 #8.

Workarounds

Restrict installation of untrusted applications through MDM configuration profiles.
Disable installation of unnecessary diagnostic or logging profiles on managed devices.
Limit sideloading and enterprise-signed applications on organizational endpoints until patches are applied.

bash

# Verify current OS version on macOS
sw_vers

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart