InfoSecBulletin Cybersecurity for mankind
Apple has issued security updates to address a zero-day flaw affecting iPhone users that is currently being exploited in attacks.
A zero-day vulnerability, CVE-2025-24085, has been fixed today. It affects Apple’s Core Media framework and allows privilege escalation on iOS, iPadOS, macOS, tvOS, watchOS, and visionOS.
“FirePass” starts its operation in Bangladesh officially
PoC Exploit Released for TP-Link Router XSS Vuln
CVE-2024-40891
Zyxel CPE Zero-Day Exploited in the Wild
Apple fixed year’s first actively exploited zero-day flaw
DeepSeek Hit by massive Cyber Attack, Limits Registrations
GitHub Desktop Vuln Credential Leaks via Malicious Remote URLs
Burp Suite 2025.1 released: Featuring Intruder Capabilities & Bug Fixes
UnitedHealth confirms 190 million impacted by 2024 data breach
Registration Open For BCS CTF 2025
New Ransomware Tactics Target VMware ESXi Via SSH Tunneling
“A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2,” Apple said today.
According to the company’s official documentation, Core Media “defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms.”
Apple has addressed CVE-2024-23222 by enhancing memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3.
Many devices are affected by this zero-day bug, including both older and newer models.
iPhone XS and later,
iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
macOS Sequoia
Apple Watch Series 6 and later
Apple TV HD and Apple TV 4K (all models)
Apple has not credited any security researcher for finding this vulnerability and has not shared details about any ongoing attacks, although it confirmed that it is being exploited.
While this zero-day bug was likely only exploited in targeted attacks, it is highly advised to install today’s security updates as soon as possible to block potentially ongoing attack attempts.
