---
title: "Apple Spring 2025 iOS Zero-Days: WebKit, CoreAudio, RPAC"
url: https://erroneo.us/security/briefs/apple-ios-zero-days-spring-2025-cve-2025-24201-31200-31201/
description: "WebKit sandbox escape (iOS 18.3.2) and CoreAudio/RPAC chain (iOS 18.4.1) used in targeted attacks. Long patched; find devices and WebKit copies left behind."
type: security-brief
section: "Security Digest"
date_published: 2025-03-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-24201", "CVE-2025-31200", "CVE-2025-31201"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple Spring 2025 iOS Zero-Days: WebKit, CoreAudio, RPAC

**Verdict: Check exposure.** Two separate targeted attacks, both fixed in spring 2025 and long since auto-installed on most devices; the work now is finding the iPhones, Macs and Linux WebKit builds that never took the updates.

- **Who must act:** Anyone with iPhones or iPads below iOS/iPadOS 18.4.1, older devices below iOS 15.8.4, 16.7.11 or iPadOS 17.7.6, Macs below Sequoia 15.4.1 or Safari 18.3.1, or Linux apps on WebKitGTK below 2.48.0.
- **Who can relax:** Fleets on current Apple releases (iOS 26.7.1 or 27.x, macOS Tahoe 26.7.1 or Sequoia 15.8.1, or the 18.7.10 build for iPhone XS and XR), which are far past all three fixes.
- **Affected:** iOS and iPadOS 18 before 18.3.2 (CVE-2025-24201) and before 18.4.1 (CVE-2025-31200, CVE-2025-31201); iOS 15 before 15.8.4, iOS 16 before 16.7.11 and iPadOS 17 before 17.7.6 (CVE-2025-24201); macOS Sequoia before 15.3.2 (CVE-2025-24201) and before 15.4.1 (CVE-2025-31200, CVE-2025-31201); Safari before 18.3.1 on macOS Ventura and Sonoma (CVE-2025-24201); visionOS before 2.4.1, tvOS before 18.4.1, watchOS before 11.5; WebKitGTK before 2.48.0 and WPE WebKit before 2.46.7 (CVE-2025-24201)
- **Fixed:** iOS and iPadOS 18.4.1 (all three); iOS and iPadOS 18.3.2 (CVE-2025-24201 only); iOS 15.8.4, iOS 16.7.11 and iPadOS 17.7.6 (CVE-2025-24201 only); macOS Sequoia 15.4.1; Safari 18.3.1; visionOS 2.4.1, tvOS 18.4.1, watchOS 11.5; WebKitGTK 2.48.0 and WPE WebKit 2.46.7
- **CVEs:** CVE-2025-24201, CVE-2025-31200, CVE-2025-31201
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below iOS/iPadOS 18.4.1, or below 15.8.4, 16.7.11 or iPadOS 17.7.6 on older hardware.
2. Check Macs with sw_vers -productVersion and the Safari version; flag Sequoia below 15.4.1 and Ventura or Sonoma Macs with Safari below 18.3.1.
3. Update to the newest build each device supports and enforce a minimum OS version in MDM.
4. On Linux, check the WebKitGTK or WPE WebKit package and update anything below 2.48.0 (WPE 2.46.7).
5. Retire or restrict iPadOS 17 and older devices, which Apple never listed as getting the CoreAudio or RPAC fixes.

### How to check if you are affected

- Apple has published no indicators of compromise, attacker names or delivery details for either attack.
- Use MDM version history to identify devices that ran an affected build while used by people likely to be targeted.
- For anyone plausibly singled out, get a professional mobile forensics review; there is no public self-check for these attacks.

## What happened

Apple patched three exploited bugs in five weeks in spring 2025. Its own wording shows they belong to two separate attacks, not one chain.

**March 11, 2025.** Apple released iOS 18.3.2, macOS Sequoia 15.3.2, visionOS 2.3.2 and Safari 18.3.1 to fix [CVE-2025-24201](https://www.cve.org/CVERecord?id=CVE-2025-24201), an out-of-bounds write in WebKit that lets "maliciously crafted web content" break out of the Web Content sandbox. The [iOS 18.3.2 note](https://support.apple.com/en-us/122281) calls it "a supplementary fix for an attack that was blocked in iOS 17.2", one that may have been used "against specific targeted individuals on versions of iOS before iOS 17.2." So the attack hit older iOS, and this patch completes an earlier fix. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-24201) scores it 10.0. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24201) on March 13.

**April 16, 2025.** iOS 18.4.1 fixed a two-step chain that Apple says was used in "an extremely sophisticated attack against specific targeted individuals on iOS." [CVE-2025-31200](https://www.cve.org/CVERecord?id=CVE-2025-31200) is memory corruption in CoreAudio: processing an audio stream in a crafted media file may lead to code execution. Apple and Google's Threat Analysis Group are credited. [CVE-2025-31201](https://www.cve.org/CVERecord?id=CVE-2025-31201), in RPAC, lets an attacker who already has arbitrary read/write bypass Pointer Authentication. CISA's ADP scores both 9.8 on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-31200), and both entered [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200) on April 17. As [Help Net Security](https://www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/) notes, Apple shared no details of who was targeted or how.

## Who is affected

CVE-2025-24201 was backported on March 31, 2025 to [iOS 15.8.4](https://support.apple.com/en-us/122345), [iOS 16.7.11](https://support.apple.com/en-us/122346) and [iPadOS 17.7.6](https://support.apple.com/en-us/122372). [Safari 18.3.1](https://support.apple.com/en-us/122285) covers Ventura and Sonoma, and watchOS 11.4 also carries the fix. Because the bug is in WebKit, Linux apps built on WebKitGTK before 2.48.0 or WPE WebKit before 2.46.7 are affected too ([WSA-2025-0002](https://webkitgtk.org/security/WSA-2025-0002.html)). The April pair was fixed in iOS 18.4.1, [macOS Sequoia 15.4.1](https://support.apple.com/en-us/122400), tvOS 18.4.1 and visionOS 2.4.1, with CoreAudio also fixed in [watchOS 11.5](https://support.apple.com/en-us/122722). Apple lists no fix for older iOS lines; whether they are affected is not disclosed as of Oct 23, 2026.

## Do you really need to act?

For most fleets, no. These fixes are 18 months old, and auto-updating devices are far past them. Apple's [current builds](https://support.apple.com/en-us/100100) are iOS 26.7.1 and 27.x, with iOS 18.7.10 for the iPhone XS and XR. The lasting risk is a stale iPhone or Mac used by someone worth targeting, or a Linux kiosk app on an old WebKitGTK build.

## What to do now

1. Pull an MDM version report. Flag iOS/iPadOS 18 below 18.4.1, and older hardware below 15.8.4, 16.7.11 or iPadOS 17.7.6.
2. On Macs, run `sw_vers -productVersion` and `defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString`. Flag Sequoia below 15.4.1, and Safari below 18.3.1 on Ventura or Sonoma.
3. Update with `sudo softwareupdate --install --all --restart` on Macs, or Settings > General > Software Update on iPhone and iPad.
4. On Linux, run `dpkg -l | grep -i webkit` or `rpm -qa | grep -i webkit` and update anything below 2.48.0.
5. Restrict iPadOS 17 and older devices from sensitive access: Apple lists no April fix for them.

## How to tell if you were hit

Apple has published no indicators, attacker names or delivery details for either attack, and we found no public research tying them to a named spyware family. Detection means version history: use MDM records to find affected builds on devices of journalists, executives, officials or administrators. For anyone plausibly singled out, get a professional mobile forensics review. Lockdown Mode is sensible hardening for such people, though Apple has not said whether it would have blocked these attacks.

## Timeline

- Mar 11, 2025 — Apple ships the WebKit fix in iOS 18.3.2 and Safari 18.3.1.
- Mar 13, 2025 — CISA adds CVE-2025-24201 to KEV.
- Mar 31, 2025 — Backports ship in iOS 15.8.4, iOS 16.7.11 and iPadOS 17.7.6.
- Apr 16, 2025 — iOS 18.4.1 and macOS 15.4.1 fix the CoreAudio and RPAC bugs.
- Apr 17, 2025 — CISA adds both to KEV.
- May 12, 2025 — watchOS 11.5 adds the CoreAudio fix.

## Sources

1. [Apple — About the security content of iOS 18.3.2 and iPadOS 18.3.2](https://support.apple.com/en-us/122281)
2. [Apple — About the security content of iOS 18.4.1 and iPadOS 18.4.1](https://support.apple.com/en-us/122282)
3. [Apple — About the security content of macOS Sequoia 15.4.1](https://support.apple.com/en-us/122400)
4. [Apple — About the security content of Safari 18.3.1](https://support.apple.com/en-us/122285)
5. [Apple — About the security content of iOS 16.7.11 and iPadOS 16.7.11](https://support.apple.com/en-us/122346)
6. [Apple — About the security content of iOS 15.8.4 and iPadOS 15.8.4](https://support.apple.com/en-us/122345)
7. [Apple — About the security content of iPadOS 17.7.6](https://support.apple.com/en-us/122372)
8. [Apple — About the security content of watchOS 11.5](https://support.apple.com/en-us/122722)
9. [Apple — Apple security releases](https://support.apple.com/en-us/100100)
10. [CVE record — CVE-2025-24201](https://www.cve.org/CVERecord?id=CVE-2025-24201)
11. [CVE record — CVE-2025-31200](https://www.cve.org/CVERecord?id=CVE-2025-31200)
12. [CVE record — CVE-2025-31201](https://www.cve.org/CVERecord?id=CVE-2025-31201)
13. [NVD — CVE-2025-24201](https://nvd.nist.gov/vuln/detail/CVE-2025-24201)
14. [NVD — CVE-2025-31200](https://nvd.nist.gov/vuln/detail/CVE-2025-31200)
15. [NVD — CVE-2025-31201](https://nvd.nist.gov/vuln/detail/CVE-2025-31201)
16. [CISA — Known Exploited Vulnerabilities: CVE-2025-24201](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24201)
17. [CISA — Known Exploited Vulnerabilities: CVE-2025-31200](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200)
18. [CISA — Known Exploited Vulnerabilities: CVE-2025-31201](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201)
19. [WebKitGTK — Security Advisory WSA-2025-0002](https://webkitgtk.org/security/WSA-2025-0002.html)
20. [Help Net Security — Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201)](https://www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/)

---
Source page: https://erroneo.us/security/briefs/apple-ios-zero-days-spring-2025-cve-2025-24201-31200-31201/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt