CVE-2025-24104

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-27 · updated 2026-06-17
Weakness: CWE-59

Description

This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a maliciously crafted backup file may lead to modification of protected system files.

Affected products

Apple iPadOS: before 17.7.4; from 18.0 before 18.3 — fixed in 17.7.4, 18.3
Apple Iphone Os: before 18.3 — fixed in 18.3

How to fix

Upgrade to a fixed version: Apple iPadOS 17.7.4, 18.3; Apple Iphone Os 18.3. Check the vendor advisory for mitigations.

References

https://support.apple.com/en-us/122066
https://support.apple.com/en-us/122067
http://seclists.org/fulldisclosure/2025/Jan/14

Get alerted when CVE-2025-24104 or the next vulnerability affects your stack