{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-24167", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-01-17T00:00:44.989Z", "datePublished": "2025-03-31T22:24:26.043Z", "dateUpdated": "2026-04-02T18:27:22.867Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A download's origin may be incorrectly associated"}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "0", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "15.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "11.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated."}], "references": [{"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122376"}, {"url": "https://support.apple.com/en-us/122379"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:27:22.867Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-01T03:58:17.736372Z", "id": "CVE-2025-24167", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T03:59:52.460Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Apr/13"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/8"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/4"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:05:51.973Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Apr/13"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/8"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/4"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:05:51.973Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-24167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-01T03:58:17.736372Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T03:59:46.195Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "15.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.4", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122379"}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "A download's origin may be incorrectly associated"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-03-31T22:24:26.043Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24167", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:05:51.973Z", "dateReserved": "2025-01-17T00:00:44.989Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-03-31T22:24:26.043Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "45D15738-9AE3-4CB5-8755-A67F6E09EAC5", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B3450F7-7B4A-46CE-A6E0-BBE6569F2EBF", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D9C73F9-FEF4-4FC1-B83D-56566AD35990", "versionEndExcluding": "18.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated."}, {"lang": "es", "value": "Este problema se solucion\u00f3 mejorando la gesti\u00f3n del estado. Este problema est\u00e1 corregido en Safari 18.4, iOS 18.4, iPadOS 18.4 y macOS Sequoia 15.4. El origen de una descarga podr\u00eda estar asociado incorrectamente."}], "id": "CVE-2025-24167", "lastModified": "2026-04-02T19:19:10.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-03-31T23:15:16.583", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122371"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122373"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122376"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122379"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/8"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T02:20:42.372801+00:00", "value": {"mitigation_remediation": ["Upgrade every Apple product to a version that includes the patch: Safari 18.4 or later, iOS 18.4 / iPadOS 18.4, macOS 15.4 or newer, and watchOS 11.4 or newer. ", "Enable or enforce file origin verification such as the built\u2011in quarantine functionality that checks the download source before execution. ", "Run an updated anti\u2011virus or endpoint protection solution that scans all downloaded files for malicious code before they are opened."], "summary": {"action": "Patch immediately", "impact": "Potential remote or local code execution through an incorrectly associated download origin"}, "threat_synthesis": {"affected_systems": "Apple\u2019s browsers and operating systems are impacted: Safari (up to 18.3), iOS and iPadOS (prior to 18.4), macOS Sequoia (pre\u201115.4), and watchOS (pre\u201111.4). The issue is documented as fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and watchOS 11.4. System administrators should verify that all Apple products are running one of the patched releases or newer.", "description_and_impact": "An Apple software flaw allows a download\u2019s origin to be incorrectly associated, meaning a file obtained from a malicious source could be treated as if it came from a trusted domain or application. The vulnerability originates from the way state is handled during download completion, and the lack of proper origin verification means a malicious file could be executed with the privileges of the user\u2019s context. Because the flaw can lead to arbitrary code execution, it poses a significant threat to confidentiality, integrity, and availability of the affected systems.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests that, at present, the probability of active exploitation is low, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, the attack vector is likely a web\u2011based or download\u2011based scenario where an attacker provides a file that appears to originate from a trusted source, enabling privilege escalation or data compromise if the file is executed."}}}}, "created": "2026-04-28T02:30:18.742767+00:00", "title": "Improper Download Origin Association in Apple Mobile and Desktop Platforms", "updated": "2026-04-28T02:30:18.742780+00:00", "vendors": [], "weaknesses": ["CWE-295"]}