CVE-2025-54502

Published Apr 16, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54502 is a vulnerability found in WebKit, which could lead to an unexpected process crash when processing maliciously crafted web content. This issue was addressed through improved checks by Apple. The fix has been implemented in various Apple operating systems and browsers, including watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2, iPadOS 18.2, and Safari 18.2.

Description: Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.
Source: psirt@amd.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7.1
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

psirt@amd.com: CWE-668

Hype score: Not currently trending

References