Apple has released iOS 18.3 and iPadOS 18.3, introducing significant security improvements with patches for more than 20 vulnerabilities across various system components.
Most notably, the update addresses a CoreMedia vulnerability that Apple confirms was actively exploited in versions of iOS prior to 17.2.
"A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2," Apple said.
The critical CoreMedia vulnerability (CVE-2025-24085) could allow malicious applications to elevate their privileges on affected devices.
Apple has implemented improved memory management to resolve this security risk, which affected iPhone XS and later models, as well as a wide range of iPad devices, including iPad Pro, iPad Air (3rd generation and later), and iPad mini (5th generation and later).
The list of devices impacted by this zero-day includes:
- iPhone XS and later,
- iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
- macOS Sequoia
- Apple Watch Series 6 and later
- Apple TV HD and Apple TV 4K (all models)
Fixed Other Flaws too
The update also patches multiple AirPlay-related vulnerabilities discovered by Uri Katz of Oligo Security. These issues could allow attackers to execute arbitrary code, cause system crashes, or perform denial-of-service attacks.
Two concerning kernel vulnerabilities were also addressed, which could have allowed malicious applications to gain root privileges or execute arbitrary code with kernel privileges.
Web browsing security has notable improvements with this release. Safari users will benefit from fixes addressing potential address bar spoofing and user interface manipulation vulnerabilities discovered by security researcher @RenwaX23. Several WebKit-related issues have been patched, including ones that could lead to user fingerprinting and denial-of-service attacks.
Other significant fixes include an authentication issue in the Photos app that could allow physical access to photos on a locked device, improvements to passkey security, and patches for various system components, including ImageIO, SceneKit, and Time Zone management.
It is highly recommended that immediate installation of the update be done due to the breadth and severity of the vulnerabilities addressed. Users can update their iPhones and iPads over the air by going to Settings > General > Software Update.
The update is available for iPhone XS and later models, with corresponding security updates for watchOS 11.3, tvOS 18.3, and macOS systems, including Sequoia 15.3, Sonoma 14.7.3, and Ventura 13.7.3.