Vulnerabilitycritical
Feds take notice of iOS vulnerabilities exploited under mysterious circumstances
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2020-27932+1 related CVE | Kernel Type Confusion in Apple iOS, macOS, watchOS Allows Code Execution (CVE-2020-27932) | 7.8 group max | 10% | KEV | KEV |
| CVE-2021-30952 | CVE-2021-30952: Integer Overflow in Apple Safari/WebKit Allows Arbitrary Code Execution | 7.8 | 7% | KEVPoC | KEV |
| CVE-2022-48503 | Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari | 8.8 | 3% | KEV | KEV |
CVE-2023-32409+1 related CVE | WebKit Sandbox Escape in Apple Safari, iOS, iPadOS, macOS, tvOS, and watchOS | 8.6 group max | 17% | KEV | KEV |
| CVE-2023-38606 | Kernel State-Tampering Flaw in Apple iOS, iPadOS, macOS, tvOS and watchOS | 5.5 | 3% | KEV | KEV |
| CVE-2023-41974 | Use-After-Free Kernel Code Execution Flaw in Apple iOS and iPadOS | 7.8 | 2% | KEVPoC | KEV |
| CVE-2023-43000 | Use-After-Free in Apple WebKit: Safari, iOS, iPadOS, macOS (CVE-2023-43000) | 8.8 | 4% | KEVPoC | KEV |
| CVE-2024-23222 | Apple WebKit Type Confusion Enables Arbitrary Code Execution Across iOS, macOS, tvOS | 8.8 | 11% | KEV | KEV |
CVE-2024-23225+1 related CVE | Memory Corruption Kernel Protection Bypass in Apple iOS, macOS, tvOS, visionOS | 7.8 | 1% | KEV | KEV |
| CVE-2025-23222 | An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root | 8.4 | <1% |
From the original article
2 min read at arstechnica.com
Coruna is also notable for its use by three distinct hacking groups. Google first detected its use in February of last year in an operation conducted by a “customer of a surveillance vendor.” The vulnerability exploited, tracked as CVE-2025-23222, had been patched 13 months earlier.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.