Apple released emergency security patches for iPhones, iPads, Macs (sequoia), Apple TV, and Vision Pro to fix two serious zero-day vulnerabilities that hackers are already using to attack devices.
The two vulnerabilities are in CoreAudio CVE-2025-31200 (severity 7.5 out of 10), which can be used to run malicious code just by playing a specially made audio or media file, and RPAC CVE-2025-31201 (severity 6.8 out of 10) that could let attackers who already have some control over device bypass a key feature called pointer authentication.
Apple said it fixed the first bug (CVE-2025-31200) by adding better checks to stop memory issues, and it fixed the second bug (CVE-2025-31201) by removing the risky part of the code.
Both bugs were discovered by Apple, and Google’s security team (TAG) also helped find the first one. Apple also mentioned that these bugs were used in a very advanced cyberattack aimed at specific people using iPhones.
With these vulnerabilities, apple has fixed five zero-day in its software since the start of the year-
- CVE-2025-24085 (CVSS score: 7.8)- a bug in the Core Media part that could permit a malicious application on a device to gain more control than the system should have.
- CVE-2025-24200 (CVSS Score: 4.6)- a weakness in the accessibility feature that could let someone physically access your locked device and turn off USB protections. It is a part of a physical cyber-attack.
- CVE-2025-24201 (CVSS score: 7.1)- an out-of-bounds write issue in the WebKit where a specially made website could break out of the safe browsing area and access more of the system than it’s supposed to.
Apple has released important security updates for these devices and systems:
- iPhone XS and higher models
- iPad Pro (13-inch, 11-inch-various generations)
- iPad Air (3rd generation and higher)
- iPad (7th generation and higher)
- iPad mini (5th generation and higher)
- Macs: macOS Sequoia 15.4.1 is available for all Macs using the Sequoia system.
- Apple TV: tvOS 18.4.1 is available for Apple TV HD and all Apple TV 4k models.
- Apple Vision Pro: visonOS 2.4.1 is available.
Since hackers are already using these security holes, apple strongly recommends updating your devices as soon as possible to stay protected.
