Vulnerability Affecting Apple devices
Lookout Coverage and Recommendation for Admins
To ensure your devices are protected, Lookout admins should take the following steps in their Lookout console:
- Set the default OS Out of Date policy to enforce a minimum iOS version of 18.3 on all devices.
- Choose whether to immediately warn or block non-compliance devices from access work apps and data until their OS is updated.
- If your risk policies allow for a grace period, set the policy to escalate in severity and limitation to the user for a short period of time that aligns with your policies.
Overview
CISA recently added guidance to CVE-2025-24085, a use-after-free issue, which affects Apple devices running on visionOS, iOS, iPadOS, macOS, tvOS, and watchOS. The problem is related to memory management, specifically when an application continues to access memory that has already been released. There has been evidence of active exploitation of this CVE against versions of iOS before iOS 17.2, and a successful exploit could allow a malicious application to elevate privileges on the device, cause applications to crash or allow malicious code execution. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3.
United States government organizations are required to have all vulnerable devices patched by February 19, 2025. While CISA’s requirement is only for US government organizations, their guidance should be a source of information for enterprise organizations, as well.
Lookout Analysis
Regardless of who builds software, it is rarely perfect. Vulnerabilities are common in the mobile ecosystem, across both hardware and software, just like they are for laptops, desktops, and any other technology. Apple has the advantage of building and maintaining both its hardware and software products, which reduces the variables that could lead to exploitable code. However, this doesn’t mean that Apple devices are impenetrable.
This incident, along with similar occurrences, demonstrates that despite the significant efforts invested in creating exploitation mitigations and conducting code audits, memory corruption vulnerabilities continue to be widespread and exploitable in practical scenarios. Without visibility into vulnerable devices across your mobile fleet, your organization and its data could be exposed to threats like this. To combat these problems, security teams should leverage mobile EDR to integrate mobile device and app vulnerability data into their SIEM, SOAR, or XDR solution
Authors
Lookout
Lookout, Inc. is the data-centric cloud security company that uses a defense-in-depth strategy to address the different stages of a modern cybersecurity attack. Data is at the core of every organization, and our approach to cybersecurity is designed to protect that data within today’s evolving threat landscape no matter where or how it moves.
