Security readout for executives and security teams
Plain-English summary
CVE-2025-24251 allows an attacker on the same local network to make an application terminate unexpectedly on affected Apple devices. The documented impact is service disruption, not data theft or modification. Apple addressed the issue with improved checks across supported iOS, iPadOS, macOS, tvOS, visionOS, and watchOS releases.
Executive priority
Schedule prompt remediation through normal patch management, prioritizing exposed or operationally important devices. The documented consequence is application disruption rather than compromise of data, so emergency shutdowns are generally unsupported by the supplied evidence. Escalate if recurring unexplained terminations affect critical services or later vendor intelligence reports exploitation.
Technical view
This is a CWE-476 null-pointer dereference vulnerability with CVSS 3.1 score 6.5. The vector indicates adjacent-network access, low complexity, no privileges, and no user interaction. Documented impact is high availability loss without confidentiality or integrity impact. The affected component and precise vulnerable version ranges are not identified in the supplied bundle.
Likely exposure
Exposure is most likely on devices running releases earlier than Apple’s listed fixed versions and connected to networks shared with potentially hostile systems. Exact vulnerable version ranges are unavailable because the supplied affected-version entries contain only placeholder values. Internet reachability is not established; the stated attack position is the local network.
Exploitation context
The supplied record is not marked as CISA KEV, and the source bundle provides no evidence of active exploitation or a public exploit. This does not prove exploitation is absent. The documented scenario requires local-network proximity but needs neither authentication nor user interaction.
Researcher notes
The CVSS vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Apple describes only “improved checks,” leaving the affected component and triggering condition unspecified. CWE-476 suggests a null-pointer dereference. Researchers should avoid inferring broader memory-corruption, code-execution, or cross-network impact without additional evidence.
Mitigation direction
- Update iPhones and iPads to iOS or iPadOS 18.4, or a later supported release.
- Update older supported iPads to iPadOS 17.7.6 or later.
- Update Macs to Sequoia 15.4, Sonoma 14.7.5, Ventura 13.7.5, or later supported releases.
- Update Apple TV, Vision Pro, and Apple Watch to tvOS 18.4, visionOS 2.4, and watchOS 11.4 respectively.
- Prioritize devices regularly connected to shared or untrusted local networks.
Validation and detection
- Inventory affected Apple device types and their installed operating-system versions.
- Confirm every device meets the applicable fixed-version threshold or runs a later supported release.
- Investigate unexplained application terminations occurring while devices are connected to shared local networks.
- Review Apple’s applicable security advisory for device-specific installation guidance and exceptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-24251 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/122371CVE reference, apple
- https://support.apple.com/en-us/122372CVE reference, apple
- https://support.apple.com/en-us/122373CVE reference, apple
- https://support.apple.com/en-us/122374CVE reference, apple
- https://support.apple.com/en-us/122375CVE reference, apple
- https://support.apple.com/en-us/122376CVE reference, apple
- https://support.apple.com/en-us/122377CVE reference, apple
- https://support.apple.com/en-us/122378CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.