Apple fixes this year’s first actively exploited zero-day bug

​Apple has released security updates to fix this year's first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users.

The zero-day fixed today is tracked as CVE-2025-24085 [iOS/iPadOS, macOS, tvOS, watchOS, visionOS] and is a privilege escalation security flaw in Apple's Core Media framework.

"A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2," Apple said today.

According to the company's official documentation, Core Media "defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms."

Apple has fixed CVE-2024-23222 with improved memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3.

The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including:

iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later macOS Sequoia Apple Watch Series 6 and later Apple TV HD and Apple TV 4K (all models)

Apple has yet to attribute the discovery of this security vulnerability to a security researcher and has not published details regarding attacks, even though it disclosed that it is exploited in the wild.

While this zero-day bug was likely only exploited in targeted attacks, it is highly advised to install today's security updates as soon as possible to block potentially ongoing attack attempts.

Last year, the company fixed a total of six zero-days, the first in January, two in March, a fourth in May, and two more in November,

One year before, in 2023, Apple patched 20 zero-day flaws exploited in the wild, including:

two zero-days (CVE-2023-42916 and CVE-2023-42917) in November two zero-days (CVE-2023-42824 and CVE-2023-5217) in October five zero-days (CVE-2023-41061, CVE-2023-41064, CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993) in September two zero-days (CVE-2023-37450 and CVE-2023-38606) in July three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439) in June three more zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373) in May two zero-days (CVE-2023-28206 and CVE-2023-28205) in April and another WebKit zero-day (CVE-2023-23529) in February