{"api_version":"1","generated_at":"2026-07-23T13:59:00+00:00","cve":"CVE-2025-24149","urls":{"html":"https://cve.report/CVE-2025-24149","api":"https://cve.report/api/cve/CVE-2025-24149.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-24149","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-24149"},"summary":{"title":"CVE-2025-24149","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to disclosure of user information.","state":"PUBLISHED","assigner":"apple","published_at":"2025-01-27 22:15:19","updated_at":"2026-04-02 19:19:07"},"problem_types":["CWE-125","Parsing a file may lead to disclosure of user information","CWE-125 CWE-125 Out-of-bounds Read"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"ADP","type":"DECLARED","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://support.apple.com/en-us/122072","name":"https://support.apple.com/en-us/122072","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122069","name":"https://support.apple.com/en-us/122069","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/19","name":"http://seclists.org/fulldisclosure/2025/Jan/19","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/14","name":"http://seclists.org/fulldisclosure/2025/Jan/14","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122070","name":"https://support.apple.com/en-us/122070","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122066","name":"https://support.apple.com/en-us/122066","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/15","name":"http://seclists.org/fulldisclosure/2025/Jan/15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/18","name":"http://seclists.org/fulldisclosure/2025/Jan/18","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/13","name":"http://seclists.org/fulldisclosure/2025/Jan/13","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/17","name":"http://seclists.org/fulldisclosure/2025/Jan/17","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122067","name":"https://support.apple.com/en-us/122067","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/16","name":"http://seclists.org/fulldisclosure/2025/Jan/16","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122071","name":"https://support.apple.com/en-us/122071","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122068","name":"https://support.apple.com/en-us/122068","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/en-us/122073","name":"https://support.apple.com/en-us/122073","refsource":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24149","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24149","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apple","product":"iOS and iPadOS","version":"affected 18.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"iPadOS","version":"affected 17.7.4 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"macOS","version":"affected 13.7.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"macOS","version":"affected 14.7.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"macOS","version":"affected 15.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"tvOS","version":"affected 18.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"visionOS","version":"affected 2.3 custom","platforms":[]},{"source":"CNA","vendor":"Apple","product":"watchOS","version":"affected 11.3 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"24149","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"ipados","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2025-24149","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-01-28T16:06:09.805211Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-03-24T17:25:34.575Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-11-03T21:04:11.326Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://seclists.org/fulldisclosure/2025/Jan/19"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/18"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/17"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/16"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/15"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/14"},{"url":"http://seclists.org/fulldisclosure/2025/Jan/13"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.3","status":"affected","version":"0","versionType":"custom"}]},{"product":"iPadOS","vendor":"Apple","versions":[{"lessThan":"17.7.4","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"13.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"14.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"15.3","status":"affected","version":"0","versionType":"custom"}]},{"product":"tvOS","vendor":"Apple","versions":[{"lessThan":"18.3","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"2.3","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"11.3","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to disclosure of user information."}],"problemTypes":[{"descriptions":[{"description":"Parsing a file may lead to disclosure of user information","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-04-02T18:12:09.381Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"url":"https://support.apple.com/en-us/122066"},{"url":"https://support.apple.com/en-us/122067"},{"url":"https://support.apple.com/en-us/122068"},{"url":"https://support.apple.com/en-us/122069"},{"url":"https://support.apple.com/en-us/122070"},{"url":"https://support.apple.com/en-us/122071"},{"url":"https://support.apple.com/en-us/122072"},{"url":"https://support.apple.com/en-us/122073"}]}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2025-24149","datePublished":"2025-01-27T21:45:42.401Z","dateReserved":"2025-01-17T00:00:44.976Z","dateUpdated":"2026-04-02T18:12:09.381Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-01-27 22:15:19","lastModifiedDate":"2026-04-02 19:19:07","problem_types":["CWE-125","Parsing a file may lead to disclosure of user information","CWE-125 CWE-125 Out-of-bounds Read"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"17.7.4","matchCriteriaId":"27995710-C1F5-4919-8168-E2B59D7F698C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0","versionEndExcluding":"18.3","matchCriteriaId":"AD29C5E9-9427-4C41-873F-C29493B892E4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"18.3","matchCriteriaId":"71A94ACA-8143-475F-8A89-8020B86CE80B"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"13.7.3","matchCriteriaId":"A12642CB-69CC-4C6E-A2C2-CA8AE736EE88"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0","versionEndExcluding":"14.7.3","matchCriteriaId":"9C523C7E-B1CF-454B-8AFD-B462C5120D9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.0","versionEndIncluding":"15.3","matchCriteriaId":"537CDDD9-1400-46B7-80C8-62B9A893E828"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","versionEndExcluding":"18.3","matchCriteriaId":"60C0BA29-0969-4181-B6F1-4606986B18E4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3","matchCriteriaId":"F91BF3D5-D8E5-437C-8301-C9F22AAFB8BD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"11.3","matchCriteriaId":"7A128237-004C-49D7-A559-5BBC38362361"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"24149","Ordinal":"1","Title":"CVE-2025-24149","CVE":"CVE-2025-24149","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"24149","Ordinal":"1","NoteData":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to disclosure of user information.","Type":"Description","Title":"CVE-2025-24149"}]}}}