Apple 2025 zero-days
CVE-2025-24085, CVE-2025-24200, CVE-2025-31200 / -31201, CVE-2025-43300 (ImageIO, KEV 21 Aug 2025, used against WhatsApp users with CVE-2025-55177)
- Disclosed
What happened
- Late-2025 WebKit pair: CVE-2025-14174 and CVE-2025-43529
Live scores
Live scores
CVE-2025-14174- EPSS
- 0.553
very likely to be attacked soon - VEDAS
- 0.984
strong exploit evidence - On CISA KEV
- Yes, since 2025-12-12
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-24085- EPSS
- 0.175
likely to be attacked soon - VEDAS
- 0.973
strong exploit evidence - On CISA KEV
- Yes, since 2025-01-29
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-24200- EPSS
- 0.045
some chance of attack soon - VEDAS
- 0.972
strong exploit evidence - On CISA KEV
- Yes, since 2025-02-12
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-31200- EPSS
- 0.209
likely to be attacked soon - VEDAS
- 0.976
strong exploit evidence - On CISA KEV
- Yes, since 2025-04-17
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-31201- EPSS
- 0.140
likely to be attacked soon - VEDAS
- 0.977
strong exploit evidence - On CISA KEV
- Yes, since 2025-04-17
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-43300- EPSS
- 0.652
very likely to be attacked soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2025-08-21
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.