InfoSecBulletin Cybersecurity for mankind
Apple has issued security updates to address a zero-day flaw affecting iPhone users that is currently being exploited in attacks.
A zero-day vulnerability, CVE-2025-24085, has been fixed today. It affects Apple’s Core Media framework and allows privilege escalation on iOS, iPadOS, macOS, tvOS, watchOS, and visionOS.
Check Point said BreachForum post old data
Apple Warns of 3 Zero Day Vulns Actively Exploited
24,000 unique IP attempted to access Palo Alto GlobalProtect portals
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
“A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2,” Apple said today.
According to the company’s official documentation, Core Media “defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms.”
Apple has addressed CVE-2024-23222 by enhancing memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3.
Many devices are affected by this zero-day bug, including both older and newer models.
iPhone XS and later,
iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
macOS Sequoia
Apple Watch Series 6 and later
Apple TV HD and Apple TV 4K (all models)
Apple has not credited any security researcher for finding this vulnerability and has not shared details about any ongoing attacks, although it confirmed that it is being exploited.
While this zero-day bug was likely only exploited in targeted attacks, it is highly advised to install today’s security updates as soon as possible to block potentially ongoing attack attempts.
