Loading story…
Apple disclosed multiple security fixes for supported iPhone and iPad devices, including CVE-2025-24200, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and CVE-2025-43200, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue.
Further reporting tied CVE-2025-43200 to a zero-click Messages exploitation chain used to install Paragon's Graphite spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for iOS 26.0.1 and iPadOS 26.0.1 fixed CVE-2025-43400, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2025-09-29, Apple published a security notice for iOS 26.0.1 and iPadOS 26.0.1 disclosing CVE-2025-43400, an out-of-bounds write that could be triggered by processing a maliciously crafted font. Apple said the issue could cause unexpected app termination or corrupt process memory and was fixed with improved bounds checking.
CSIRT.SK reported that, according to Citizen Lab, CVE-2025-43200 was exploited to install Paragon's Graphite spyware on the mobile devices of several journalists in Europe. The same reporting described the flaw as a zero-click remote code execution issue in Messages involving photo and video content shared through iCloud links.
On 2025-06-12, Apple published a security notice documenting the February fixes and the newly added CVE-2025-43200 entry. The notice credited Bill Marczak of Citizen Lab for reporting CVE-2025-24200 and described both vulnerabilities as potentially exploited against specific targeted individuals.
On 2025-06-11, Apple updated its advisory to include CVE-2025-43200, a logic issue triggered by a maliciously crafted photo or video shared through an iCloud Link. Apple said this second flaw may also have been exploited in sophisticated targeted attacks.
On 2025-02-10, Apple released iOS 18.3.1 and iPadOS 18.3.1 to address CVE-2025-24200, which could let a physical attacker disable USB Restricted Mode on a locked device. Apple said the flaw may have been exploited in extremely sophisticated attacks against specific targeted individuals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
support.apple.com
Open sourcecsirt.sk
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple issued security updates across its ecosystem to address **multiple vulnerabilities** affecting *iOS, iPadOS, macOS, tvOS, watchOS,* and *visionOS*, with impacts including **remote code execution (RCE)**, denial of service, elevation of privilege, information disclosure, data manipulation, and security restriction bypass. HKCERT highlighted **CVE-2026-20700** as a **high-risk** issue and noted it is **being exploited in the wild**; the flaw is described as an **improper restriction of operations within the bounds of a memory buffer** that could allow arbitrary code execution when an attacker has memory-write capability. Apple’s iOS 26.3 and iPadOS 26.3 security content includes fixes for issues that could expose sensitive information on a locked device (e.g., **CVE-2026-20645** and **CVE-2026-20674**) and a Bluetooth-related denial-of-service condition where a privileged network attacker could trigger DoS using crafted packets (**CVE-2026-20650**). The updates apply to **iPhone 11 and later** and a range of supported iPad models, and Apple reiterated its policy of publishing details after patches are available.
Jul 23, 2026
Apple published security advisories detailing vulnerability fixes across multiple iOS and iPadOS versions, including iOS/iPadOS **16.7**, **17.2**, **18.1**, **18.3**, **26.1**, and **26.2**. The advisories describe a range of impacts such as sandbox escapes (including Web Content sandbox breakout), privacy issues where apps could access or expose sensitive user data via insufficient log redaction, file-system modification via temporary-file handling, and memory-safety flaws (e.g., out-of-bounds reads, type confusion, and bounds-checking issues) that could lead to crashes or memory corruption. Apple attributes fixes to changes like improved protocol handling, cache handling, input validation, and additional permission restrictions, and references issues by **CVE** where available. Several advisories also highlight device-state and authentication/logic weaknesses: iOS/iPadOS 18.3 includes a case where an attacker with physical access to an **unlocked** device could access Photos while the app is locked (`CVE-2025-24141`), while iOS/iPadOS 18.1 includes a lock-screen exposure issue (`CVE-2024-44274`) and a Shortcuts-related path-handling flaw that could allow arbitrary shortcut execution without user consent (`CVE-2024-44255`). The iOS/iPadOS 26.x advisories include privacy and permission issues (e.g., identifying installed apps, screenshots of sensitive embedded views), potential kernel memory corruption/system termination conditions, and logic/UI issues affecting security posture (e.g., passcode requirement timing after Face ID enrollment restore scenarios and potential FaceTime caller ID spoofing), with multiple findings credited to external researchers and teams (including Google Project Zero, ByteDance IES Red Team, and others).
Jun 29, 2026
Apple released security updates to address an **actively exploited zero-day** tracked as **CVE-2026-20700**, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to *iOS 26*. The flaw affects **`dyld` (Apple’s dynamic linker)** and can allow **arbitrary code execution** when an attacker already has **memory write** capability; reporting attributes discovery to **Google’s Threat Analysis Group** and notes it may have been used as part of an exploit chain. Apple shipped fixes across its ecosystem, including *iOS 26.3*, *iPadOS 26.3*, *macOS Tahoe 26.3*, *watchOS 26.3*, *tvOS 26.3*, and *visionOS 26.3*. The same reporting indicates Apple also issued patches tied to the broader report for **CVE-2025-14174** (an out-of-bounds memory access issue in Chrome’s **ANGLE** graphics component on Mac) and **CVE-2025-43529** (a **use-after-free** leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by **patch deployment speed**—particularly where updates rely on end users rather than enforced device management.
Jun 29, 2026