Loading vulnerability…
CVE-2025-24203 is an Apple kernel vulnerability affecting macOS Ventura, macOS Sonoma, macOS Sequoia, iOS, iPadOS, tvOS, visionOS, and watchOS. Apple describes the issue as allowing an app to modify protected parts of the file system. The vendor states the issue was addressed with improved checks, indicating insufficient enforcement of protection boundaries or authorization checks in kernel-mediated file system operations. No further public technical detail about the specific vulnerable function or code path is provided in the supplied content.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides an iOS application (iDevice_ZH) that leverages the CVE-2025-24203 vulnerability in the XNU kernel to perform system-level modifications without requiring a jailbreak. The main exploit is implemented in C (iDevice_ZH/exploit.c), which abuses the VM_BEHAVIOR_ZERO_WIRED_PAGES bug to allow a user-level process to zero out (overwrite with zeros) a page of a read-only file, even if it is owned by root. The exploit is triggered from the Swift-based iOS app, which provides a user interface for selecting and applying various 'tweaks' to system files. These tweaks are defined in JSON files (TweakRepo/tweaks.json, iDevice_ZH/default_tweaks.json) and target specific system file paths to modify UI elements, disable sounds, or change fonts. The app includes features for managing, importing, and exporting custom tweaks, and can fetch updates from GitHub. The attack vector is local, requiring the app to be executed on the target device. The exploit is operational, as it provides a working payload and a user interface for practical use. The repository is structured as a full Xcode project with Swift and C code, resource files, and configuration for building and distributing the app.
This repository contains a proof-of-concept (POC) exploit for CVE-2025-24203, targeting Apple iOS versions 16.0 through 18.3.2. The exploit is written in C and is based on research by Ian Beer of Google Project Zero, with minor improvements to error logging. The main exploit file, 'exploit.c', demonstrates a local privilege escalation technique by mapping a user-supplied file into memory, then using the Mach kernel's vm_behavior_set with the VM_BEHAVIOR_ZERO_WIRED_PAGES flag to zero out the file's contents in memory. This can be used to overwrite files and enable certain iOS tweaks without requiring a jailbreak, similar in effect to the MacDirtyCow exploit. The exploit requires the user to specify a file path on the device, which is the main fingerprintable endpoint. The repository is structured simply, with a README providing context and usage instructions, and a single C source file implementing the exploit logic.
The 'dirtyZero' repository is an iOS application written in Swift that exploits CVE-2025-24203, a kernel vulnerability discovered by Ian Beer of Google Project Zero. The app provides a user-friendly interface for applying a variety of in-memory tweaks to the iOS user interface, such as disabling backgrounds, icons, and other UI elements on the home screen, lock screen, control center, and more. The exploit works by zeroing out specific memory pages of system files, temporarily disabling or altering their effects until the device is rebooted. The repository includes the main app code, Swift extensions, tweak definitions (with many system file paths as targets), and a proof-of-concept exploit implementation in 'unwire_mlock_poc.swift'. No persistent changes are made to the filesystem; all modifications are reverted on reboot. The app targets iOS versions 16.0-16.7.12, 17.0-17.7.5, and 18.0-18.3.2. The repository also includes build scripts and Xcode project files, but the core exploit logic is in the Swift source files, particularly the tweak application logic and the memory manipulation PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.