Apple released emergency updates for actively exploited flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-31200 +1 in the same advisory: …31201 | Memory Corruption in Apple iOS, iPadOS, macOS Audio Processing Enables Code Execution CVE-2025-31200 is a memory corruption flaw (CWE-119) in Apple's audio stream handling, fixed with improved bounds checking, that allows code execution when a device processes an audio stream in a maliciously crafted media file. An attacker who can deliver such a file to a vulnerable Apple device can gain arbitrary code execution with full confidentiality, integrity, and availability impact (CVSS 3.1: 9.8 critical, network vector). Affected products are iOS, iPadOS, macOS (Sequoia), tvOS, visionOS, and watchOS on versions released before the April 2025 fixes. Apple stated the issue was exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before 18.4.1, and CISA added it to the KEV on 2025-04-17; EPSS estimates a 19.7% (97th percentile) probability of exploitation within 30 days. Public analyses describe it chained with the WebKit flaw CVE-2025-31201, which Apple patched in the same emergency updates. Do: Update all Apple devices immediately: iOS/iPadOS 18.4.1 or later, macOS Sequoia 15.4.1 or later, tvOS 18.4.1 or later, visionOS 2.4.1 or later, and watchOS 11.5 or later; the same updates also fix the related actively exploited WebKit zero-day CVE-2025-31201. The flaw is in CISA KEV (added 2025-04-17), so US federal agencies must apply the updates per BOD 22-01 or discontinue use. Verify installed OS versions in Settings > General > About (iOS/iPadOS) or About This Mac, and prioritize high-risk/targeted users for immediate patching and review. | 9.8 | 19% | KEV PoC ×2 |
| masswell over 1 billion Apple devices (iOS/iPadOS/macOS active installed base; all devices on pre-18.4.1/15.4.1 OS versions at disclosure were affected) |
Full article266 words · extracted from securityaffairs.com · click to collapse
Apple released emergency updates to fix iOS, iPadOS & macOS vulnerabilities actively exploited in sophisticated attacks.
Apple released out‑of‑band security updates to address two vulnerabilities, tracked as CVE-2025-31200 and CVE-2025-31201, impacting iOS, iPadOS & macOS. The company confirmed that the flaws have been exploited in a small number of “extremely sophisticated” attacks against iOS targets.
Below are the descriptions of the two vulnerabilities:
- CoreAudio (CVE-2025-31200) – The vulnerability is a memory corruption issue that was addressed with improved bounds checking. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS. The company acknowledged Google’s TAG (Threat Analysis Group) for reporting this flaw.
- RPAC (CVE-2025-31201) – An attacker with read/write access could bypass Pointer Authentication on iOS. Apple confirmed it may have been exploited in highly targeted, sophisticated attacks. Apple addressed the flaw by removing the vulnerable code.
Security patches are available for the following devices: iPhone XS and later, iPad Pro 13-inch, iPad Pro 13.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later.
As usual, Apple has not shared technical details about the attacks. However, the limited, targeted nature of these attacks against iOS users suggests that commercial surveillance vendors or a nation-state actor likely exploited the flaws.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, iOS users)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/176644/security/apple-emergency-updates-actively-exploited-ios-ipados-macos-bugs.html