CVE-2025-24150: Apple iPadOS

High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days.

A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from Web Inspector may lead to command injection.

Affected products

• Apple iPadOS: before 18.3 (fixed in 18.3)
• Apple iPhone OS: before 18.3 (fixed in 18.3)
• Apple macOS: before 15.3 (fixed in 15.3)
• Apple Safari: before 18.3 (fixed in 18.3)

Published 2025-01-27. Last modified 2026-06-17.