Monday, February 10, 2025
HomeAppleTwo zero-day Flaws With Apple iPhones and iPads Let Attackers to Hack...

Two zero-day Flaws With Apple iPhones and iPads Let Attackers to Hack Devices Just by Sending Emails

Published on

SIEM as a Service

Follow Us on Google News

Security researchers from ZecOps discovered two zero-day vulnerabilities with default email mailing app present in Apple iPhones and iPads let attackers take over the devices by just sending an email.

The vulnerability has been exploited by attackers since at least January 2018, targeting iOS high-profile users.

An attacker could exploit the vulnerability by sending a specially crafted email to a victim’s mailbox enabling it to trigger vulnerability with the context of the email application with iOS MobileMail application on iOS 12 or maild on iOS 13.

It affects all the devices above iOS 6 and unable to confirm with earlier versions as they are not available in the market. The vulnerability affects iOS 13.4.1 also.

Two zero-day Vulnerabilities

The flaw resides with the implementation of MFMutableData present in the MIME library that lacks checking ftruncate() that leads to the Out-Of-Bounds write.

Researchers also found a way to trigger OOB-Write without waiting to fail for ftruncate and also found a heap overflow that can be triggered remotely.

The vulnerability can be triggered even before the email downloaded is complete, so the email doesn’t reside in the device.

In case if the attack is failed then a message stating “This message has no content” sent to the attacker.

Apple iPhones and iPads
Failed Attack

With iOS 13 the vulnerability can be triggered without user interaction, and on iOS 12 users need to click on the email to get hacked.

Successful exploitation of the vulnerability allows attackers to leak, modify, and delete emails, chaining with kernel vulnerabilities allow attackers to get complete remote access.

If the vulnerability exploited on the device, then users a temporary slowdown of a mobile mail application, and no other anomalous behavior observed.

The vulnerability was discovered by the researchers on February 19th, 2020 and it has been fixed newly released beta update of 13.4.5.

If you are unable to update then it is recommended to switch with other email clients not vulnerable to these bugs.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Over 3.5 Million iPhone & iPad Users Installed Malicious Fleeceware from Apple’s App Store

Apple Agrees To Pay $500 Million in Settlement For Slowing Down The Older iPhones to Buy New Models

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

DeepSeek iOS App Leaks Data to ByteDance Servers Without Encryption

DeepSeek iOS app—a highly popular AI assistant recently crowned as the top iOS app...

Malicious Android & iOS Apps Downloaded Over 242,000 Times, Stealing Crypto Recovery Keys

A sophisticated malware campaign, dubbed SparkCat, has infiltrated Google Play and Apple’s App Store,...

Apple’s macOS Kernel Vulnerability (CVE-2025-24118) Exposes Users to Privilege Escalation Attacks – PoC Released

A critical privilege escalation vulnerability in Apple's macOS kernel has been revealed, posing a...