SB2025051304 - Multiple vulnerabilities in Apple iPadOS 17
Published: May 13, 2025 Updated: November 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 secuirty vulnerabilities.
1) Spoofing attack (CVE-ID: CVE-2025-24225)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Mail Addressing. A remote attacker can trick the victim into opening a specially crafted email address and spoof user interface.
2) Type Confusion (CVE-ID: CVE-2025-31206)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a type confusion error within the WebKit engine. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and crash the browser.
3) Improper access control (CVE-ID: CVE-2025-31215)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
4) Improper input validation (CVE-ID: CVE-2025-31217)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in WebKit. A remote attacker can trick the victim into opening a specially crafted website and perform an unexpected Safari crash.
5) Type confusion (CVE-ID: CVE-2025-24213)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error. A remote attacker can trick the victim into visiting a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Information disclosure (CVE-ID: CVE-2025-31220)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Weather. A local application can read sensitive location information.
7) Information exposure through log files (CVE-ID: CVE-2025-31242)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in StoreKit. A local application can access sensitive user data.
8) Information exposure through log files (CVE-ID: CVE-2025-31213)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Security. A local application can access associated usernames and websites in a user\'s iCloud Keychain.
9) Integer overflow (CVE-ID: CVE-2025-31221)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to integer overflow in Security. A remote attacker can trigger integer overflow and read parts of kernel memory.
10) Improper access control (CVE-ID: CVE-2025-31245)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in Pro Res. A local application can cause unexpected system termination.
11) Improper access control (CVE-ID: CVE-2025-24259)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Parental Controls. A local application can retrieve Safari bookmarks without an entitlement check.
12) Missing Authorization (CVE-ID: CVE-2025-31228)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to missing authorization in Notes. An attacker with physical access to device can access notes from the lock screen.
13) Stack-based buffer overflow (CVE-ID: CVE-2024-8176)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling XML content. A remote attacker can pass specially crafted XML content to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
14) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-24097)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a permissions issue in AirDrop. A local application can read arbitrary file metadata.
15) Double free (CVE-ID: CVE-2025-31241)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the OS kernel. A remote attacker trigger a double free error and crash the system.
16) Buffer overflow (CVE-ID: CVE-2025-31219)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing Microsoft Office files. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
17) Memory leak (CVE-ID: CVE-2025-24144)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due memory leak within the OS kernel. A local application can obtain sensitive kernel state.
18) Improper access control (CVE-ID: CVE-2025-31226)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service.
19) Missing Authorization (CVE-ID: CVE-2025-30448)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing authentication. A remote attacker can turn on sharing of an iCloud folder without authentication.
20) Input validation error (CVE-ID: CVE-2025-31210)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in FaceTime. A remote attacker can trick the victim into viewing a specially crafted web content and perform a denial of service (DoS) attack.
21) Buffer overflow (CVE-ID: CVE-2025-31233)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in CoreMedia when processing video files. A remote attacker can create a specially crafted video file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
22) Use after free (CVE-ID: CVE-2025-31239)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in CoreMedia. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected app termination.
23) Out-of-bounds read (CVE-ID: CVE-2025-31209)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in CoreGraphics. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
24) Improper input validation (CVE-ID: CVE-2025-31196)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in CoreGraphics. A remote attacker can trick the victim into opening a specially crafted file and perform a denial-of-service or potentially disclose memory contents.
25) Improper access control (CVE-ID: CVE-2025-31208)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in CoreAudio. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected app termination.
26) Double free (CVE-ID: CVE-2025-31235)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Audio. A remote attacker can trick the victim into opening a specially crafted media file, trigger a double free error and perform a denial of service (DoS) attack.
27) Buffer overflow (CVE-ID: CVE-2025-31251)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing specially crafted image files in AppleJPEG. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and crash the application.
28) Buffer overflow (CVE-ID: CVE-2025-24111)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Display. A local application can trigger memory corruption and escalate privileges on the system.
29) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-24220)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Sandbox Profiles. A local application can read a persistent device identifier.
30) Input validation error (CVE-ID: CVE-2025-31216)
The vulnerability allows an attacker to override managed Wi-Fi profiles.
The vulnerability exists due to insufficient validation of user-supplied input within the Wi-Fi component. An attacker with physical access to device can override managed Wi-Fi profiles.
31) Out-of-bounds read (CVE-ID: CVE-2025-43374)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Wi-Fi component. A remote attacker on the local network can send specially crafted packets to the system, trigger an out-of-bounds read error and read contents of kernel memory.
Remediation
Install update from vendor's website.