macOS · macOS update · January 27, 2025
Sequoia 15.3
Sequoia 15.3, released January 27, 2025, fixes 66 CVEs in Sequoia. One of them is being exploited (CVE-2025-24085); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
66
9 rated Critical
Exploited
1
CVE-2025-24085
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.1740
97th percentile
Priority of the 66 CVEs
Patch now 1
Urgent 8
High 19
Routine 38
Applies to
| Product | Version |
|---|---|
| Sequoia | 15.3 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2025-24085 | CoreMedia: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. | A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. | 10.0 | 0.1740 | KEVExploited |
| Urgent | CVE-2025-24118 | Kernel: An app may be able to cause unexpected system termination or write kernel memory | An app may be able to cause unexpected system termination or write kernel memory | 9.8 | 0.0375 | None reported |
| Urgent | CVE-2025-24126 | AirPlay: An attacker on the local network may be able to corrupt process memory | An attacker on the local network may be able to corrupt process memory | 9.8 | 0.0136 | None reported |
| Urgent | CVE-2025-24154 | WebContentFilter: An attacker may be able to cause unexpected system termination or corrupt kernel memory | An attacker may be able to cause unexpected system termination or corrupt kernel memory | 9.1 | 0.0116 | None reported |
| Urgent | CVE-2025-24102 | CoreRoutine: An app may be able to determine a user’s current location | An app may be able to determine a user’s current location | 9.8 | 0.0095 | None reported |
| Urgent | CVE-2025-24146 | Photos Storage: Deleting a conversation in Messages may expose user contact information in system logging | Deleting a conversation in Messages may expose user contact information in system logging | 9.8 | 0.0086 | None reported |
| Urgent | CVE-2025-24103 | Security: An app may be able to access protected user data | An app may be able to access protected user data | 9.8 | 0.0065 | None reported |
| Urgent | CVE-2025-24130 | PackageKit: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 9.8 | 0.0064 | None reported |
| Urgent | CVE-2025-24109 | AppleMobileFileIntegrity: An app may be able to access sensitive user data | An app may be able to access sensitive user data | 9.8 | 0.0050 | None reported |
| High | CVE-2025-24150 | WebKit Web Inspector: Copying a URL from Web Inspector may lead to command injection | Copying a URL from Web Inspector may lead to command injection | 8.8 | 0.0294 | None reported |
| High | CVE-2025-24158 | WebKit: Processing web content may lead to a denial-of-service | Processing web content may lead to a denial-of-service | 8.8 | 0.0136 | None reported |
| High | CVE-2025-24129 | AirPlay: An attacker on the local network may cause an unexpected app termination | An attacker on the local network may cause an unexpected app termination | 7.5 | 0.0131 | None reported |
| High | CVE-2025-24162 | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0097 | None reported |
| High | CVE-2025-24120 | WindowServer: An attacker may be able to cause unexpected app termination | An attacker may be able to cause unexpected app termination | 7.5 | 0.0096 | None reported |
| High | CVE-2025-24137 | AirPlay: An attacker on the local network may corrupt process memory | An attacker on the local network may corrupt process memory | 8.0 | 0.0095 | None reported |
| High | CVE-2025-24177 | AirPlay: An attacker on the local network may be able to cause a denial-of-service | An attacker on the local network may be able to cause a denial-of-service | 7.5 | 0.0084 | None reported |
| High | CVE-2025-24143 | WebKit: A maliciously crafted webpage may be able to fingerprint the user | A maliciously crafted webpage may be able to fingerprint the user | 8.8 | 0.0081 | None reported |
| High | CVE-2025-24169 | Passwords: A malicious app may be able to bypass browser extension authentication | A malicious app may be able to bypass browser extension authentication | 7.5 | 0.0075 | None reported |
| High | CVE-2025-24189 | WebKit: Processing maliciously crafted web content may lead to memory corruption | Processing maliciously crafted web content may lead to memory corruption | 8.8 | 0.0075 | None reported |
| High | CVE-2025-24156 | Xsan: An app may be able to elevate privileges | An app may be able to elevate privileges | 8.8 | 0.0051 | None reported |
| High | CVE-2024-55549 | libxslt: Processing maliciously crafted web content may lead to an unexpected process crash | Processing maliciously crafted web content may lead to an unexpected process crash | 7.8 | 0.0036 | None reported |
| High | CVE-2025-24159 | Kernel: An app may be able to execute arbitrary code with kernel privileges | An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0032 | None reported |
| High | CVE-2025-24139 | sips: Parsing a maliciously crafted file may lead to an unexpected app termination | Parsing a maliciously crafted file may lead to an unexpected app termination | 7.8 | 0.0028 | None reported |
| High | CVE-2025-24174 | iCloud Photo Library: An app may be able to bypass Privacy preferences | An app may be able to bypass Privacy preferences | 7.7 | 0.0026 | None reported |
| High | CVE-2025-24119 | Finder: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges | An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges | 7.8 | 0.0024 | None reported |
Showing 1 to 25 of 66
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.