A critical vulnerability in iOS could allow malicious applications to disable iPhones with just a single line of code permanently.

The vulnerability, assigned CVE-2025-24091, leverages the operating system’s Darwin notifications system to trigger an endless reboot cycle, effectively “bricking” devices and requiring a complete system restore.

iOS Darwin Notification Vulnerability

The vulnerability exploits Darwin notifications, a low-level messaging mechanism within the CoreOS layer that allows processes to communicate system-wide events.

Unlike more commonly known notification systems such as NSNotificationCenter or NSDistributedNotificationCenter, Darwin notifications are part of a legacy API that operates at a fundamental level across Apple’s operating systems.

“Darwin notifications are even simpler, as they’re a part of the CoreOS layer. They provide a low-level mechanism for simple message exchange between processes on Apple’s operating systems,” explained Guilherme Rambo, the security researcher who discovered the vulnerability.

The critical flaw stems from the fact that any application on iOS could send sensitive system-level Darwin notifications without requiring special privileges or entitlements.

The most dangerous aspect was that these notifications could trigger powerful system functions, including entering a “restore in progress” mode.

The One-Line Exploit

The exploit is remarkably simple- just a single line of code could trigger the vulnerability:

When executed, this code forces the device to enter a “Restore in Progress” state. Since no actual restore is occurring, the process inevitably fails, prompting the user to restart the device. The researcher created a proof-of-concept attack called “VeryEvilNotify” that implemented this exploit within a widget extension.

“Widget extensions are periodically woken up in the background by iOS,” noted the researcher.

“Because of how widespread the use of widgets is on the system, when a new app that includes a widget extension is installed and launched, the system is very eager to execute its widget extension”.

By placing the exploit in a widget that repeatedly crashes after sending the notification, the researcher created a persistent attack that would trigger after each restart, creating an endless loop that rendered the device unusable.

Risk Factors	Details
Affected Products	iOS (iPhones and iPads running versions prior to iOS/iPadOS 18.3)
Impact	Denial of Service (DoS)
Exploit Prerequisites	Any sandboxed app or widget extension can trigger the exploit; no special privileges required
CVSS 3.1 Score	High

Mitigations

Apple addressed the vulnerability in iOS 18.3 by implementing a new entitlement system for sensitive Darwin notifications. The researcher was awarded a bug bounty of $17,500.

Specifically, system notifications now require the prefix “com.apple.private.restrict-post.” and sending processes must possess restricted entitlements in the form of “com.apple.private.darwin-notification.restrict-post.

This isn’t the first Darwin-related vulnerability in Apple’s systems. Previously, Kaspersky Lab identified a “Darwin Nuke” vulnerability that could allow remote attackers to initiate denial of service attacks through specifically crafted network packets.

All iPhone users are strongly advised to update to iOS 18.3 or later immediately. Devices running earlier versions remain vulnerable to this attack, which could be deployed through seemingly innocent applications or widgets available through the App Store or other distribution methods.

The case highlights the ongoing security challenges in mobile operating systems, where even simple and overlooked legacy APIs can pose significant risks when improperly secured.

Are you from the SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

The post New iOS Critical Vulnerability That Could Brick iPhones With a Single Line of Code appeared first on Cyber Security News.