CVE-2025-24085

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: Feb. 18, 2026 13 articles
VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
13.07%
probability
This CVE has a 13.07% probability of being exploited in the next 30 days.
0% Top 94.2th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero
Use after free in CoreMedia

Attack Intelligence

Google Project Zero

Patched
Jan. 27, 2025
Reported by
???
Root Cause Analysis
???

Exploits & PoC

Signal Intelligence

Confidenceⓘ
95%
EPSS 13.07%
Mentions 13
Last Seen Dec 13, 2025

CNA Information

Analyst Note

CVE-2025-24085 is a critical use-after-free vulnerability (CVSS 10.0) in Apple's operating systems with confirmed active exploitation in the wild targeting iOS versions before 17.2, corroborated by multiple credible news sources describing sophisticated attacks. The vulnerability has been officially patched across multiple Apple platforms (visionOS 2.3, iOS/iPadOS 18.3, macOS 15.3, watchOS 11.3, tvOS 18.3) and reported by Google Project Zero, providing strong evidence of legitimacy.

Threat Actors 8

Hacking Team
apt_group 🇮🇹 IT
Infy
apt_group Information theft and espionage 🇮🇷 IR
Red Dev 17
apt_group 🇨🇳 CN
Soft Cell
apt_group Information theft and espionage 🇨🇳 CN
The White Company
apt_group Information theft and espionage 🇨🇳 CN
Patched Lightning
apt_group 🇬🇭 GH
Mana Team
apt_group 🇨🇳 CN
Operation Triangulation
apt_group Information theft and espionage 🇷🇺 RU

Triage Info

Decided atFeb 18, 2026