Update Your iPhone: Apple Warns of Hackers Exploiting iOS Flaw

Apple has uncovered hackers exploiting a vulnerability in iOS that appears to have been lingering for more than a year. 

On Monday, the company issued the patch for the flaw in the iOS 18.3 release for iPhones. In the bug notes, Apple indicates that malicious software applications have been abusing the vulnerability to increase their access to system privileges.  

The company added: “Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2,” which was released in December 2023. Apple iPhone models from 2018’s XS and up are all affected. 

The vulnerability, dubbed CVE-2025-24085, involves how iOS processes multimedia files through a software framework called Core Media. The same framework suffered from a memory corruption error, called a “use after free” bug, which can cause unstable behavior — paving a way to tamper with the software. 

Although details are thin, Apple’s bug report suggests the hackers exploited the vulnerability starting over a year ago, possibly through fake apps designed to play media files. Since the attack went undetected for so long, the hackers may have used the vulnerability against specific high-value targets to hijack their iPhone devices. 

CVE-2025-24085 also represents the first “zero-day” vulnerability that Apple has fixed for this year so far. In response, the company has not only issued a patch for iPhones and iPads, but also for macOS Sequoia, watchOS, tvOS and even Apple’s Vision Pro headset. Users can update their iPhones by going to Settings > General > Software Update. The phone can also patch itself automatically if you’ve toggled on automatic updates.

SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.”,”first_published_at”:”2021-09-30T21:22:09.000000Z”,”published_at”:”2025-01-23T16:44:01.000000Z”,”last_published_at”:”2025-01-23T16:43:49.000000Z”,”created_at”:null,”updated_at”:”2025-01-23T16:44:01.000000Z”})” x-show=”showEmailSignUp()” x-intersect.once=’window.trackGAImpressionEvents(“pcmag-on-site-newsletter-block”, “SecurityWatch”, $el)’ readability=”32.838445807771″>

Like What You’re Reading?

Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.

This newsletter may contain advertising, deals, or affiliate links.
By clicking the button, you confirm you are 16+ and agree to our
Terms of Use and
Privacy Policy.
You may unsubscribe from the newsletters at any time.

About Michael Kan

Senior Reporter

I’ve been working as a journalist for over 15 years—I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017.

Read Michael’s full bio

Read the latest from Michael Kan