Apple fixes two zero-days exploited in targeted iPhone attacks

Apple released emergency security updates to patch two zero-day vulnerabilities that were used in an « extremely sophisticated attack » against specific targets’ iPhones.

The two vulnerabilities are in CoreAudio (CVE-2025-31200) and RPAC (CVE-2025-31201), with both bugs impacting iOS, macOS, tvOS, iPadOS, and visionOS.

« Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS, » reads an Apple security bulletin released today.