Apple Patches Actively Exploited Zero-Day Vulnerabilities

The installation of the updates that have just appeared for the users of Apple’s mobile platforms has a certain urgency. Because the closed security gaps are zero -days – i.e. weak points that are already being used actively.

Probably a state trojan

The both zero-day gaps concern central components of the iOS/iPados system – Coraudio and RPAC – and, according to Apple, were used against targeted individuals as part of “extremely sophisticated” attacks. However, according to the group, there is no threat to the broad users. The first weak point (CVE 2025-31200) concerns Coraudio, a central interface for audio processing. According to Apple, opening a manipulated media file could lead to harmful code on the device. The gap was closed by an improved memory check.

The second vulnerability (CVE 2025-31201) is more technical and potentially more critical. It affects the RPAC security subsystem, which is deeply anchored in the architecture of iOS. Attackers with appropriate rights were able to handle the Pointer authentication here – a protective measure against memory attacks. Apple reacted drastically and completely removed the affected code.

Install update!

Apple usually only makes the active use of such vulnerabilities public if there is special pressure to act. The cautious choice of words and the fact that no details are given or goals are reminiscent of earlier cases of state-broken surveillance, for example in connection with the Pegasus spyware in 2021. So it can be assumed that the weaknesses play a role either for the espionage or in state Trojans.

The critical gaps were closed with the iOS and iPados versions 18.4.1. Users of an iPhone XS or new and compatible iPad are strongly recommended to install the update immediately. Corresponding security updates are also available for other platforms such as MacOS Sequoia (15.4.1), TVOS (18.4.1) and Visionos (2.4.1), which can be accessed via the system settings.