actively-exploited-vulnerabilitywidely-deployed-product-advisoryendpoint-software-vulnerabilitystate-sponsored-espionage

Apple Patched iPhone and iPad Flaws Linked to Targeted Spyware Attacks

Active Exploitation · 3 sources · Updated 3mo ago · First seen Sep 29, 2025

Apple disclosed multiple security fixes for supported iPhone and iPad devices, including CVE-2025-24200, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and CVE-2025-43200, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue.

Further reporting tied CVE-2025-43200 to a zero-click Messages exploitation chain used to install Paragon's Graphite spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for iOS 26.0.1 and iPadOS 26.0.1 fixed CVE-2025-43400, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Feb 10, 2025 – Sep 29, 2025

Sep 29, 20251y ago
Apple publishes iOS 26.0.1 and iPadOS 26.0.1 font parsing fix
On 2025-09-29, Apple published a security notice for iOS 26.0.1 and iPadOS 26.0.1 disclosing CVE-2025-43400, an out-of-bounds write that could be triggered by processing a maliciously crafted font. Apple said the issue could cause unexpected app termination or corrupt process memory and was fixed with improved bounds checking.
About the security content of iOS 26.0.1 and iPadOS 26.0.1 - Apple Support
Jun 24, 20251y ago
Citizen Lab links CVE-2025-43200 exploitation to Paragon Graphite spyware
CSIRT.SK reported that, according to Citizen Lab, CVE-2025-43200 was exploited to install Paragon's Graphite spyware on the mobile devices of several journalists in Europe. The same reporting described the flaw as a zero-click remote code execution issue in Messages involving photo and video content shared through iCloud links.
Februárové zraniteľnosti v operačných systémoch Apple boli zneužité na inštaláciu špionážneho softvéru | CSIRT.SK
Jun 12, 20251y ago
Apple publishes updated security notice for iOS 18.3.1 and iPadOS 18.3.1
On 2025-06-12, Apple published a security notice documenting the February fixes and the newly added CVE-2025-43200 entry. The notice credited Bill Marczak of Citizen Lab for reporting CVE-2025-24200 and described both vulnerabilities as potentially exploited against specific targeted individuals.
About the security content of iOS 18.3.1 and iPadOS 18.3.1 - Apple Support
Jun 11, 20251y ago
Apple adds CVE-2025-43200 to its February advisory
On 2025-06-11, Apple updated its advisory to include CVE-2025-43200, a logic issue triggered by a maliciously crafted photo or video shared through an iCloud Link. Apple said this second flaw may also have been exploited in sophisticated targeted attacks.
About the security content of iOS 18.3.1 and iPadOS 18.3.1 - Apple Support
Feb 10, 20252y ago
Apple releases iOS 18.3.1 and iPadOS 18.3.1 fixes for exploited flaws
On 2025-02-10, Apple released iOS 18.3.1 and iPadOS 18.3.1 to address CVE-2025-24200, which could let a physical attacker disable USB Restricted Mode on a locked device. Apple said the flaw may have been exploited in extremely sophisticated attacks against specific targeted individuals.
About the security content of iOS 18.3.1 and iPadOS 18.3.1 - Apple Support

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Zero-click remote code execution in Apple Messages via iCloud Link media (CVE-2025-43200)USB Restricted Mode bypass in Apple iOS and iPadOS Accessibility (CVE-2025-24200)

Affected products

5 linked

Ipad MiniIpadosIpadIphoneIos

Organizations

1 linked

Apple

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Apple SupportAdvisories · Sep 29, 2025

About the security content of iOS 26.0.1 and iPadOS 26.0.1 - Apple SupportOpen source ↗

Csirt SkNews · Jun 24, 2025

Februárové zraniteľnosti v operačných systémoch Apple boli zneužité na inštaláciu špionážneho softvéru | CSIRT.SKOpen source ↗

Apple SupportAdvisories · Jun 12, 2025

About the security content of iOS 18.3.1 and iPadOS 18.3.1 - Apple SupportOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News