Apple fixes this year’s first actively exploited zero-day bug

​Apple has released security updates to fix this year's first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users. The zero-day fixed today is tracked as CVE-2025-24085 [iOS/iPadOS, macOS, tvOS, watchOS, visionOS] and is a privilege escalation security flaw in Apple's Core Media framework. "A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2," Apple said today. According to the company's official documentation, Core Media "defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms." Apple has fixed CVE-2024-23222 with improved memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3. The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including: Apple has yet to attribute the discovery of this security vulnerability to a security researcher and has not published details regarding attacks, even though it disclosed that it is exploited in the wild. While this zero-day bug was likely only exploited in targeted attacks, it is highly advised to install today's security updates as soon as possible to block potentially ongoing attack attempts. Last year, the company fixed a total of six zero-days, the first in January, two in March, a fourth in May, and two more in Novemb...