Apple Patches Critical Safari Zero-Day Exploited in the Wild

Apple has swiftly addressed a critical zero-day vulnerability in its Safari browser, identified as CVE-2025-24201, which has been actively exploited in the wild. This vulnerability, which affects multiple Apple products, was patched on March 11, 2025, just one day after its disclosure, underscoring the urgency of the threat. CVE-2025-24201 is an out-of-bounds write issue, categorized under CWE-787, with a maximum CVSS score of 10, indicating its critical nature. The flaw allows attackers to execute arbitrary code, potentially leading to unauthorized actions on affected devices. The vulnerability has been listed in the Known Exploited Vulnerabilities (KEV) catalog since March 13, 2025, highlighting its significance and the need for immediate remediation. The vulnerability impacts a broad range of Apple operating systems and devices, including Safari 18.3.1, iOS 15.8.4, iPadOS 15.8.4, iOS 16.7.11, iPadOS 16.7.11, iOS 18.3.2, iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, and watchOS 11.4. Apple has released updates for all these platforms to mitigate the risk posed by this vulnerability. The exploitation of CVE-2025-24201 was notably rapid, with attackers leveraging the flaw within just 1.2 days of its disclosure. This swift exploitation underscores the sophistication of the threat actors involved and the critical need for organizations and individuals to apply patches without delay. Two proof-of-concept (PoC) exploits are already available, which could facilitate further attacks if systems remain unpatched. Security experts emphasize the importance of updating affected systems immediately to protect against potential exploitation. The low Exploit Prediction Scoring System (EPSS) score of 0.002 might suggest a lower likelihood of widespread exploitation, but the active use of this vulnerability in the wild indicates a significant threat to unpatched systems. Organizations using Apple products should prioritize these updates as part of their security posture. Given the critical nature of this vulnerability and its active exploitation, failure to patch could result in severe security breaches, data loss, or unauthorized access to sensitive information. Apple's prompt response in releasing patches across its ecosystem reflects the company's commitment to security, but it also highlights the persistent threat landscape that organizations must navigate. As attackers continue to exploit zero-day vulnerabilities with increasing speed, maintaining up-to-date systems remains a crucial defense strategy.