Loading vulnerability…
Sandbox Escape in Apple libxpc
CVE-2025-24178 is a sandbox escape vulnerability in Apple's libxpc component affecting multiple Apple operating systems prior to iOS 18.4, iPadOS 17.7.6 and 18.4, macOS Ventura 13.7.5, macOS Sonoma 14.7.5, macOS Sequoia 15.4, tvOS 18.4, and watchOS 11.4. The flaw allows an application to break out of the platform application sandbox. Apple states the issue was addressed through improved state management, indicating the vulnerability stemmed from incorrect handling of internal state within libxpc that could be abused to violate sandbox isolation boundaries.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a malicious application to escape the intended sandbox restrictions enforced by the operating system. This can enable access to resources, services, or data outside the app's normal containment boundary and may undermine a core platform security control. Depending on the surrounding environment and available post-escape primitives, this could facilitate broader unauthorized actions on the device.
If you can’t patch tonight, do this now.
No specific workaround is available from the vendor. Risk can be reduced by limiting installation of untrusted applications, enforcing application allowlisting and mobile device management controls where available, and promptly applying the relevant Apple security updates.
Patch, then assume compromise.
Apply the vendor fixes by upgrading to iOS 18.4, iPadOS 17.7.6 or 18.4 as applicable, macOS Ventura 13.7.5, macOS Sonoma 14.7.5, macOS Sequoia 15.4, tvOS 18.4, or watchOS 11.4. Organizations should prioritize patching supported Apple devices because the vulnerability affects a security boundary intended to contain malicious or compromised applications.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.