Skip to content
Fencer Intel
critical 10.0

CVE-2025-24201 kev in the critical feed json

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.

published last yr. modified 4mo ago also EUVD-2025-6302

cvss
10.0
version 3.1, CNA
cisa kev
Exploited
added 2025-03-13
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • Apple Safari 18.3.1
  • Apple iOS and iPadOS 15.8.4, 16.7.11, 18.3.2
  • Apple iPadOS 17.7.6
  • Apple macOS 15.3.2
  • Apple visionOS 2.3.2
  • Apple watchOS 11.4
  • chromium Debian 12 134.0.6998.88-1~deb12u1
  • wpewebkit Debian 14, Debian 13 2.48.0-1
  • webkit2gtk Debian 12 2.48.0-1~deb12u1
  • webkit2gtk Debian 14, Debian 13 2.48.0-1

debian advisories DEBIAN-CVE-2025-24201

  • webkit2gtk Ubuntu 22.04 LTS 2.48.0-0ubuntu0.22.04.1
  • webkit2gtk Ubuntu 24.04 LTS 2.48.0-0ubuntu0.24.04.1

ubuntu advisories UBUNTU-CVE-2025-24201

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • webkit2gtk3 RHEL 9 2.46.6-2.el9_5
  • webkit2gtk3-jsc RHEL 9 2.46.6-2.el9_5
  • webkit2gtk3 RHEL 8 2.46.6-2.el8_10
  • webkit2gtk3-jsc RHEL 8 2.46.6-2.el8_10
  • webkitgtk4 RHEL 7 ELS 2.48.3-2.el7_9
  • webkitgtk4-jsc RHEL 7 ELS 2.48.3-2.el7_9
  • webkit2gtk3 RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 2.46.6-2.el8_6
  • webkit2gtk3-jsc RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 2.46.6-2.el8_6

red hat advisories RHSA-2025:10364RHSA-2025:3034RHSA-2025:3002RHSA-2025:3005RHSA-2025:3001RHSA-2025:3000

  • webkit2gtk3 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.48.5-150400.4.122.1
  • webkit2gtk4 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.48.5-150400.4.122.1
  • webkit2gtk3-soup2 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 2.48.5-150400.4.122.1
  • webkit2gtk3 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 2.48.5-150200.150.1
  • webkit2gtk3 SLE Module for Desktop Applications 15 SP7, SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 2.48.5-150600.12.43.1
  • webkit2gtk4 SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP7 +2 more 2.48.5-150600.12.43.1
  • webkit2gtk3-soup2 SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.48.5-150600.12.43.1
  • webkit2gtk3 SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 2.48.0-150600.12.33.1

suse advisories SUSE-SU-2025:02973-1SUSE-SU-2025:02777-1SUSE-SU-2025:02766-1SUSE-SU-2025:02765-1SUSE-SU-2025:1149-1SUSE-SU-2025:1023-1

  • libqt5-qtwebengine openSUSE Tumbleweed 5.15.19-1.1

opensuse advisories openSUSE-SU-2025:15531-1

  • webkit2gtk3 AlmaLinux 8 2.46.6-2.el8_10
  • webkit2gtk3-jsc AlmaLinux 8 2.46.6-2.el8_10
  • webkit2gtk3 AlmaLinux 9 2.46.6-2.el9_5
  • webkit2gtk3-jsc AlmaLinux 9 2.46.6-2.el9_5

almalinux advisories ALSA-2025:2863ALSA-2025:2864

  • webkit2gtk3 Rocky Linux 8 2.46.6-2.el8_10

rocky linux advisories RLSA-2025:2863

  • qt5-qtwebengine Alpine 3.21 5.15.17-r7
  • qt5-qtwebengine Alpine 3.23, Alpine 3.22 5.15.17-r10
  • qt6-qtwebengine Alpine 3.24, Alpine 3.23, Alpine 3.22 6.8.2-r3

alpine advisories ALPINE-CVE-2025-24201

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-24201 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-24201 updated cvss 7.5

webkitgtk: out-of-bounds write vulnerability

  • Red Hat Enterprise Linux 6 webkitgtk
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 webkitgtk3, libwebkit2gtk
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.46.6-2.el8_10, webkit2gtk3-jsc 2.46.6-2.el8_10
    fixed: vendor fix RHSA-2025:2863
  • Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.46.6-2.el9_5, webkit2gtk3-jsc 2.46.6-2.el9_5
    fixed: vendor fix RHSA-2025:2864
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) webkit2gtk3 2.46.6-2.el8_2, webkit2gtk3-jsc 2.46.6-2.el8_2
    fixed: vendor fix RHSA-2025:3002
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) webkit2gtk3 2.46.6-2.el8_4, webkit2gtk3-jsc 2.46.6-2.el8_4
    fixed: vendor fix RHSA-2025:3005
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) webkit2gtk3 2.46.6-2.el8_6, webkit2gtk3-jsc 2.46.6-2.el8_6
    fixed: vendor fix RHSA-2025:3034
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) webkit2gtk3 2.46.6-2.el8_4, webkit2gtk3-jsc 2.46.6-2.el8_4
    fixed: vendor fix RHSA-2025:3005
show 8 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) webkit2gtk3 2.46.6-2.el8_6, webkit2gtk3-jsc 2.46.6-2.el8_6
    fixed: vendor fix RHSA-2025:3034
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) webkit2gtk3 2.46.6-2.el9_0, webkit2gtk3-jsc 2.46.6-2.el9_0
    fixed: vendor fix RHSA-2025:3000
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) webkit2gtk3 2.46.6-2.el8_8, webkit2gtk3-jsc 2.46.6-2.el8_8
    fixed: vendor fix RHSA-2025:2998
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) webkit2gtk3 2.46.6-2.el9_2, webkit2gtk3-jsc 2.46.6-2.el9_2
    fixed: vendor fix RHSA-2025:3001
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) webkit2gtk3 2.46.6-2.el9_4, webkit2gtk3-jsc 2.46.6-2.el9_4
    fixed: vendor fix RHSA-2025:2997
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) webkit2gtk3 2.46.6-2.el8_4, webkit2gtk3-jsc 2.46.6-2.el8_4
    fixed: vendor fix RHSA-2025:3005
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) webkit2gtk3 2.46.6-2.el8_6, webkit2gtk3-jsc 2.46.6-2.el8_6
    fixed: vendor fix RHSA-2025:3034
  • Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4 2.48.3-2.el7_9, webkitgtk4-jsc 2.48.3-2.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-doc 2.48.3-2.el7_9, webkitgtk4-devel 2.48.3-2.el7_9, webkitgtk4-debuginfo 2.48.3-2.el7_9, webkitgtk4-jsc-devel 2.48.3-2.el7_9
    fixed: vendor fix RHSA-2025:10364

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. 0-day patched (Project Zero)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
last yr.
Patch by
2025-04-03 (last yr.)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Apple, Multiple Products
CISA name
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched
2025-03-11
Details
project zero tracker

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1189 Drive-by Compromise exploitation
  • T1456 Drive-By Compromise exploitation, mobile
  • T1059 Command and Scripting Interpreter primary impact
  • T1623 Command and Scripting Interpreter primary impact, mobile

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
11mo ago

Exploit prediction

3.85% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Apple Safari
  • Apple iOS and iPadOS
  • Apple iPadOS
  • Apple macOS
  • Apple visionOS
  • Apple watchOS

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.