Apple has issued an urgent security advisory regarding three critical zero-day vulnerabilities, CVE-2025-24200, CVE-2025-24201 , and CVE-2025-24085, which have been exploited in sophisticated attacks.
See also: EncryptHub exploited zero-day vulnerability in Microsoft Management Console
These vulnerabilities affect a wide range of Apple devices, including iPhones, iPads, Macs, and other platforms. Users are advised to update their devices immediately to mitigate potential security risks.
CVE-2025-24200
The first vulnerability, tracked as CVE-2025-24200, is an authorization error that can be exploited in a physical attack to disable USB Restricted Mode on a locked device.
According to Apple's announcement, this zero-day vulnerability "may have been exploited in a highly sophisticated attack against specific targeted individuals."
The vulnerability was discovered and reported by Bill Marczak of The Citizen Lab at the Munk School of the University of Toronto. A malicious user could disable USB Restricted Mode on a locked device as part of a cyberattack.
USB Restricted Mode, introduced in iOS 11.4.1, prevents iOS and iPadOS devices from communicating with connected accessories if the device hasn't been unlocked within the last hour — a critical security feature designed to thwart forensic analysis tools.
See also: Fixes for Windows zero-day vulnerability affecting NTLM
CVE-2025-24201
The second vulnerability, CVE-2025-24201, affects WebKit, the browser engine that powers Safari and many iOS apps.
This issue could allow maliciously crafted web content to escape the Web Content.
Apple describes it as “a supplemental fix for an attack that was blocked in iOS 17.2” and acknowledges that it “may have been exploited in a highly sophisticated attack against specific targeted individuals in versions of iOS prior to iOS 17.2.”
See also: Google Chrome: Fixed serious zero-day vulnerability
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
CVE-2025-24085
The third zero-day vulnerability, CVE-2025-24085 , is a use-after-free vulnerability in the CoreMedia component , which is a framework that manages audio and video playback on Apple products
As Apple states in its announcement, “A malicious application may be able to elevate privileges.” This vulnerability affects multiple versions operating systems , including iOS, iPadOS, macOS, watchOS, and tvOS. This vulnerability has been actively exploited in older versions of iOS prior to version 17.2.
Source: cybersecuritynews
