Article Details
Scrape Timestamp (UTC): 2025-01-27 19:20:48.224
Original Article Text
Click to Toggle View
Apple fixes this year’s first actively exploited zero-day bug. Apple has released security updates to fix this year's first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users. The zero-day fixed today is tracked as CVE-2025-24085 [iOS, macOS, tvOS, watchOS] and is a privilege escalation security flaw in Apple's Core Media framework. "A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2," Apple said today. According to the company's official documentation, Core Media "defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms." Apple has fixed CVE-2024-23222 with improved memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3. The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including: Apple has yet to attribute the discovery of this security vulnerability to a security researcher and has not published details regarding attacks, even though it disclosed that it is exploited in the wild. While this zero-day bug was likely only exploited in targeted attacks, it is highly advised to install today's security updates as soon as possible to block potentially ongoing attack attempts. Last year, the company fixed a total of six zero-days, the first in January, two in March, a fourth in May, and two more in November, One year before, in 2023, Apple patched 20 zero-day flaws exploited in the wild, including:
Daily Brief Summary
Apple patched a zero-day vulnerability, identified as CVE-2025-24085, impacting iPhones among other devices, which was actively exploited.
This zero-day involves a privilege escalation flaw within Apple's Core Media framework, affecting iOS, macOS, tvOS, and watchOS.
The critical security update was rolled out in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3 to address the vulnerability.
Apple reported the bug was exploited prior to the iOS 17.2 version and suggested installing the updates immediately due to ongoing attack risks.
No attribution has been made to a security researcher for discovering the flaw, and specific details about the attacks remain undisclosed.
The vulnerability affects a broad range of devices, from older to newer models, making the potential impact extensive.
Apple's history shows a pattern of patching multiple zero-days annually, including six in the previous year and 20 in 2023.