Research · Mar 11, 2025 · ZeroDay Catalog
Critical Out-of-Bounds Write Vulnerability in Apple WebKit Products
Apple has addressed a significant out-of-bounds write vulnerability in WebKit that could allow unauthorized actions through malicious web content.
What changed
Apple has released updates to address an out-of-bounds write vulnerability in WebKit, which could lead to unauthorized actions if exploited. This issue has been resolved with enhanced checks in several product versions.
The vulnerability was identified as potentially exploitable in targeted attacks against specific individuals, particularly in versions prior to iOS 17.2.
- Fixed in Safari 18.3.1, iOS 15.8.4, iPadOS 15.8.4, iOS 16.7.11, iPadOS 16.7.11, iOS 18.3.2, iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, and watchOS 11.4.
- The fix includes improved checks to prevent unauthorized actions from maliciously crafted web content.
Who is affected
This vulnerability impacts a range of Apple products that utilize the WebKit engine, potentially exposing users to significant risks.
Affected products include:
- Safari browser across various platforms.
- iOS devices, including iPhones and iPads running versions before the updates.
- macOS systems using the affected WebKit version.
- visionOS and watchOS devices that rely on WebKit functionalities.
What to do
Users and administrators are strongly advised to update their devices to the latest versions as soon as possible to mitigate the risk associated with this vulnerability.
Regularly check for updates and apply them promptly to ensure the security of your devices.
- Update to the latest version of Safari and iOS/iPadOS/macOS as specified in the release notes.
- Monitor security advisories from Apple for any further developments regarding this vulnerability.
- Educate users about the risks of malicious web content and encourage safe browsing practices.