Apple Backports Zero-Day Fixes to Older iOS and macOS Versions

Apple Extends Zero-Day Patches to Older Devices

Apple has released critical security updates that backport fixes for actively exploited zero-day vulnerabilities to older iOS and macOS versions.

These updates follow Apple’s previous security patches for the latest operating systems, ensuring that older devices remain protected against high-risk exploits.

Zero-Day Fixes Now Available for Older iOS and macOS Versions

The first backport addresses CVE-2025-24200, a vulnerability discovered by Citizen Lab that allowed forensic tools to disable USB Restricted Mode on locked devices. Initially fixed in iOS 18.3.1 and iPadOS 18.3.1, Apple has now rolled out patches to:

• iOS 16.7.11 and 15.8.4

• iPadOS 16.7.11 and 15.8.4

The second vulnerability, CVE-2025-24201, allowed attackers to bypass WebKit’s Web Content sandbox using specially crafted web content. Apple described the attacks exploiting this flaw as “extremely sophisticated”. Initially patched in iOS 18.3.2, iPadOS 18.3.2, and macOS Sequoia 15.3.2, the fix has now been extended to older devices.

Another major fix addresses CVE-2025-24085, a privilege escalation flaw in Apple’s Core Media framework. The vulnerability was first patched in:

• iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3

Now, the fix has been extended to:

• iPadOS 17.7.6

• macOS 14.7.5 (Sonoma) and macOS 13.7.5 (Ventura)