How do I check whether I am affected by CVE-2024-23225?

Check the device OS version in Settings > General > About (iOS/iPadOS) or About This Mac (macOS) against Apple's security release notes for CVE-2024-23225.

What is the fix for CVE-2024-23225?

Update to the Apple OS release that lists CVE-2024-23225 as fixed; the sources do not name the version. If no update is available, follow the vendor mitigation instructions named in the CISA required action.

Who is not affected by CVE-2024-23225?

Not affected if: fixed-os-version-installed.

Live › vulnerability › CVE-2024-23225

Go to dashboard

high7.8Exploited in the wildInfrastructure

A memory corruption issue was addressed with improved validation

A memory corruption flaw in the Apple kernel across iOS, iPadOS, macOS, tvOS, watchOS and visionOS lets code bypass kernel memory protections. It is listed as exploited in the wild, and the attacker needs arbitrary kernel read and write capability first.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Mar 5, 2024 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 6, 2024.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker with kernel read/write gains full control of the device kernel.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2024-23225

Go to dashboard

high7.8Exploited in the wildInfrastructure

A memory corruption issue was addressed with improved validation

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Mar 5, 2024 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 6, 2024.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker with kernel read/write gains full control of the device kernel.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Apple Multiple Products	vendor	–	–
apple ipados	vendor	< 16.7.6	16.7.6
apple ipados	vendor	>= 17.0, < 17.4	17.4
apple iphone os	vendor	< 16.7.6	16.7.6
apple iphone os	vendor	>= 17.0, < 17.4	17.4
apple macos	vendor	>= 12.0, < 12.7.4	12.7.4
apple macos	vendor	>= 13.0, < 13.6.5	13.6.5
apple macos	vendor	>= 14.0, < 14.4	14.4
apple tvos	vendor	< 17.4	17.4
apple visionos	vendor	< 1.1	1.1
apple watchos	vendor	< 10.4	10.4

A memory corruption issue was addressed with improved validation

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

A memory corruption issue was addressed with improved validation

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources