CVE-2025-24104: Apple iPadOS

Medium severity, CVSS 5.5. EPSS: 1.5% chance of exploitation in the next 30 days.

This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a maliciously crafted backup file may lead to modification of protected system files.

Affected products

• Apple iPadOS: before 17.7.4 (fixed in 17.7.4); from 18.0, before 18.3 (fixed in 18.3)
• Apple iPhone OS: before 18.3 (fixed in 18.3)

Published 2025-01-27. Last modified 2026-06-17.