CVE-2025-24200: Apple Patches Zero-Day Exploit Targeting iPhones

Apple has released out-of-band security updates on Monday to address a critical vulnerability in iOS and iPadOS. This zero-day flaw, tracked as CVE-2025-24200, has already been exploited in real-world attacks, underscoring the severity of the issue and the need for immediate action.

CVE-2025-24200

The vulnerability is categorized as an authorization issue that allows malicious actors to disable USB Restricted Mode on locked devices. This flaw enables attackers to bypass a critical security feature designed to protect iPhones and iPads from unauthorized data access during physical attacks.

Introduced with iOS 11.4.1, USB Restricted Mode prevents devices from communicating with external accessories unless they’ve been unlocked within the past hour. This security feature was primarily developed to thwart digital forensics tools like Cellebrite and GrayKey, often used by law enforcement agencies to extract data from seized devices.

Physical Access Required

Exploiting CVE-2025-24200 requires physical access to the target device, suggesting that attackers would likely use it in highly targeted scenarios. This aligns with Apple’s acknowledgment that the flaw was part of an “extremely sophisticated attack” aimed at specific individuals.

Security researcher Bill Marczak from The Citizen Lab at the University of Toronto’s Munk School discovered and reported the flaw. The Citizen Lab is renowned for its investigative work into government surveillance and the misuse of spyware technologies.

Affected Devices and Immediate Update Recommendations

Apple has released patches for a wide range of devices to mitigate this vulnerability:

• iOS 18.3.1 and iPadOS 18.3.1: Compatible with iPhone XS and later, iPad Pro (13-inch, 12.9-inch 3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (7th generation and later), and iPad mini (5th generation and later).

• iPadOS 17.7.5: Targeted for older devices, including iPad Pro (12.9-inch 2nd generation), iPad Pro (10.5-inch), and iPad (6th generation).

Actionable Advice:

• Update Immediately: Users should install the latest updates as soon as possible to secure their devices against potential exploitation.

• Enable Automatic Updates: To ensure timely protection against future threats, enable automatic updates under device settings.

• Physical Security Measures: Since the exploit requires physical access, users should remain vigilant, especially in public spaces, and consider using strong device passcodes.

A Pattern of Exploits: Recent Apple Zero-Days

This emergency patch follows closely on the heels of another critical security flaw, CVE-2025-24085, a use-after-free bug in the Core Media component. Apple disclosed that this vulnerability had been actively exploited in devices running versions of iOS prior to 17.2.

Apple’s recurring zero-day vulnerabilities highlight the persistent targeting of its ecosystem by sophisticated threat actors. Notably, many of these exploits are weaponized by commercial surveillance vendors to deploy spyware capable of extracting sensitive data from compromised devices.