Security readout for executives and security teams
Plain-English summary
Apple fixed a flaw that could label a download with the wrong origin. This may undermine security decisions that depend on knowing where downloaded content came from, although the sources do not describe specific attack outcomes. The supplied CVSS score is 9.8, making prompt updating appropriate.
Executive priority
Treat remediation as urgent because the supplied severity is critical and the issue affects widely used Apple platforms. Prioritize internet-facing and download-heavy user populations, then resolve unsupported-device exceptions. Do not describe this as actively exploited based on the current evidence.
Technical view
CVE-2025-24167 is a state-management flaw affecting download-origin association. Apple addressed it through improved state management in Safari 18.4, iOS and iPadOS 18.4, macOS Sequoia 15.4, and watchOS 11.4. The public bundle provides no CWE, exact affected-version ranges, trigger conditions, or technical root-cause detail.
Likely exposure
Devices below the named fixed releases may warrant review, but the sources do not define precise vulnerable version ranges. Exposure is most relevant where Apple devices or Safari handle downloads and origin attribution informs user or security controls.
Exploitation context
The supplied record is not in CISA KEV, and no cited source reports active exploitation or public exploit availability. The CVSS vector indicates remote, low-complexity, unauthenticated, no-interaction impact, but the available technical detail is insufficient to confirm practical attack conditions.
Researcher notes
Public detail is sparse: incorrect download-origin association and improved state management are the only disclosed mechanics. No CWE, affected build boundaries, proof of concept, or downstream trust decision is documented. The CVSS 9.8 assessment signals potentially severe impact, but independent reproduction and exploitability cannot be evaluated from this bundle.
Mitigation direction
- Update Safari to 18.4 or later where applicable.
- Update iOS and iPadOS devices to 18.4 or later.
- Update macOS Sequoia systems to 15.4 or later.
- Update Apple Watch devices to watchOS 11.4 or later.
- Check Apple security guidance for unsupported releases or additional remediation details.
Validation and detection
- Inventory Safari, iOS, iPadOS, macOS Sequoia, and watchOS versions.
- Confirm managed devices report the named fixed release or a later version.
- Verify update deployment succeeded rather than relying only on policy assignment.
- Review exceptions for devices unable to receive the fixed releases.
- Monitor Apple advisories and the CVE record for clarified affected ranges or exploitation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-24167 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/122371CVE reference, apple
- https://support.apple.com/en-us/122373CVE reference, apple
- https://support.apple.com/en-us/122376CVE reference, apple
- https://support.apple.com/en-us/122379CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.