Apple’s iOS 18.3 and iPadOS 18.3 updates contain key security improvements and patch actively exploited vulnerabilities. Here’s why you should update today.
On Monday, after a series of developer betas, Apple released iOS 18.3 to the general public. While the update contains a variety of noteworthy enhancements and features, including changes to Apple Intelligence notification summaries, the operating system also includes important security patches.
As with most iOS updates, iOS 18.3 addresses core security issues related to different features and aspects of the iPhone operating system. Many of the changes introduced on Monday were designed to prevent local and remote attackers from accessing users’ private information.
Apple also patched a vulnerability that appears to have been actively exploited on older iOS versions, as well as security issues that enabled unauthorized Bluetooth usage and gave apps root permissions. With iOS 18.3, attackers won’t have as many vulnerabilities to exploit, making the iPhone operating system safer for the average user.
Most notably, iOS 18.3 fixes a key vulnerability that was actively used by bad actors. According to Apple, the company is aware of a report indicating that a CoreMedia issue was exploited on operating system versions older than iOS 17.2.
The now-patched CoreMedia issue made it possible for an app to elevate privileges, an issue that Apple resolved through the use of improved memory management.
While the other security vulnerabilities fixed by iOS 18.3 aren’t known to have been used by attackers, that doesn’t make the fixes any less important. Apple addressed multiple security issues that would have enabled denial-of-service attacks, arbitrary code execution, and that would have let attackers gain access to users’ personal information.
Other fixes in iOS 18.3 that keep your data safe.
One now-patched Accessibility vulnerability, discovered by Abhay Kailasia, made it possible for attackers with physical access to an unlocked device to access information from the Photos app. This was the case even when the app itself was locked, though the authentication issue has since been addressed with improved state management.
A now-patched Accessibility vulnerability enabled unauthorized access to the Photos app.
Apple also fixed a privacy issue related to time zones, which let apps view certain contacts’ phone numbers via system logs. This vulnerability was resolved through the use of improved data redaction for log entries.
iOS 18.3 addressed an out-of-bounds read issue that previously affected SceneKit, where parsing a file would have led to the disclosure of user information. Following its discovery by Michael DePlante of the Trend Micro Zero Day initiative, Apple patched the vulnerability via improved bounds checking.
A now-patched LaunchService issue made it possible for apps to fingerprint the user. The iOS 18.3 update patches this vulnerability through improvements in sensitive data redaction.
iOS 18.3 prevents unauthorized Bluetooth access, resolves kernel security issues
A vulnerability in open-source code meant that iOS apps were able to receive unauthorized access to the iPhone’s Bluetooth feature, which is used for AirDrop and connecting various accessories such as headphones. As the issue was found in open-source code, its CVE-ID (CV-2024-9956) was issued and handled by a third party.
iOS 18.3 also contains multiple Kernel-related fixes. Most notably, a now-patched permissions issue made it possible for a malicious application to gain root access. Apple addressed the Kernel vulnerability by implementing additional restrictions.
A separate Kernel-related validation issue, meanwhile, allowed applications to execute arbitrary code with kernel privileges. iOS 18.3 patches this security issue through the use of improved logic.
iOS 18.3 security fixes prevent denial-of-service attacks
Apple has resolved multiple vulnerabilities that would have allowed for denial-of-service attacks. Uri Katz of Oligo Security discovered different security issues that affected AirPlay and made it possible for remote attackers or attackers “in a privileged position” to perform DOS attacks.
The iOS 18.3 update resolves multiple vulnerabilities involving AirPlay, some of which made denial-of-service attacks possible.
The iOS 18.3 update addressed these two AirPlay vulnerabilities via improved input validation, and improved memory handling, respectively. Apple also used improved memory handling to fix an unrelated ImageIO security issue that enabled DOS attacks.
Three now-patched AirPlay issues allowed attackers to cause unexpected app terminations and system terminations. The different AirPlay vulnerabilities also made it possible to corrupt process memory and enable arbitrary code execution. The iOS 18.3 update resolves these AirPlay-related issues, meaning that potential attackers will no longer be able to utilize any of them.
Safari received patches for two separate vulnerabilities, which enabled the spoofing of the address bar and iOS user interface through the use of malicious websites. Apple addressed these two security issues via additional logic and user interface improvements, respectively.
Safari got multiple security fixes with the iOS 18.3 update.
WebKit, meanwhile, received fixes for three different security issues. One of them enabled denial-of-service attacks by processing web content, an issue that Apple dealt with by implementing improved memory handling.
The other two WebKit vulnerabilities patched with iOS 18.3 revolved around malicious web content that was able to fingerprint the user, or cause an unexpected process crash, respectively. The former was patched with improved filesystem restrictions, while the latter was resolved through improved state management.
WebContentFilter received an important security fix, patching a vulnerability that let attackers corrupt kernel memory or cause unexpected system terminations. Apple also resolved a privacy issue that affected the WebKit Web Inspector and enabled command injection by copying a URL. The former was addressed via improved input validation, while the latter was fixed through improvements in file handling.
Other security fixes in the iOS 18.3 update
Overall, the iOS 18.3 update contains more than 20 different security fixes and patches a wide variety of vulnerabilities. The full list of security updates and fixes for iOS 18.3 can be seen on Apple’s website. Alongside the patched vulnerabilities already mentioned here, Apple resolved issues with ARKit, CoreAudio, and CoreMedia.
It’s important to always keep your operating system up-to-date. Apple’s latest security fixes ensure that bad actors have a much more difficult time obtaining your private user data, on some occasions even patching actively used exploits, as was the case with the iOS 18.3 update.
