InfoSecBulletin Cybersecurity for mankind
On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly sophisticated attacks targeting a few iOS users.
The vulnerabilities CVE-2025-31200 and CVE-2025-31201 allow for code execution and bypass mitigation on Apple’s iOS, iPadOS, and macOS platforms.
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Apple acknowledged a report indicating that both flaws were exploited in targeted attacks on specific iPhones.
Here’s Apple’s description of the software defects:
CoreAudio (CVE-2025-31200) — Processing an audio stream in a malicious media file could lead to code execution. Apple is aware of reports that this vulnerability may have been exploited in a sophisticated attack on specific iOS users. A memory corruption problem was fixed with better bounds checking, as reported by Google’s Threat Analysis Group (TAG).
RPAC (CVE-2025-31201) — An attacker with read and write access could potentially bypass Pointer Authentication. Apple has been informed of a report suggesting this issue may have been exploited in a sophisticated attack targeting specific individuals on iOS. The problem has been fixed by removing the vulnerable code.
Pointer Authentication is a security feature in some ARM architectures that ensures a pointer hasn’t been tampered with through cryptographic methods.
Vulnerabilities on macOS Sequoia have been fixed, but Apple reports that exploitation has been limited to a few iPhones. As usual, Apple did not provide details or IOCs about these exploits.
