CISA Issues Warning on Apple Vulnerabilities Exploited Through DarkSword iOS Chain

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding three critical security flaws affecting the Apple ecosystem.

Officially added to the Known Exploited Vulnerabilities (KEV) catalog on March 20, 2026, these bugs are actively being abused in the wild.

Attackers are stringing these specific flaws together to deploy a highly sophisticated attack sequence known as the DarkSword iOS chain, which ultimately allows for total device takeover.

The DarkSword exploit chain represents a multi-stage attack that targets the core foundation of Apple’s operating systems.

The attack typically initiates when a victim is lured into loading maliciously crafted web content through Safari or an in-app browser.

This triggers a memory corruption vulnerability, granting the threat actor initial execution rights. Once inside the system, the attacker forces the device to process a malicious application in the background.

This application exploits a classic buffer overflow to write directly into the device’s kernel memory.

Finally, an improper locking vulnerability is weaponized to manipulate memory shared between active processes, solidifying the attacker’s deep system control.

Vulnerability Breakdown

• CVE-2025-31277 (Buffer Overflow): Associated with CWE-119, this vulnerability allows maliciously crafted web content to trigger memory corruption across Safari, iOS, iPadOS, macOS, watchOS, tvOS, and visionOS.
• CVE-2025-43520 (Classic Buffer Overflow): Linked to CWE-120, this flaw enables a malicious application to cause unexpected system termination or write directly to kernel memory on iOS, iPadOS, macOS, watchOS, tvOS, and visionOS.
• CVE-2025-43510 (Improper Locking): Tracked under CWE-667, this issue allows a malicious application to cause unexpected changes in memory shared between processes on iOS, iPadOS, macOS, watchOS, tvOS, and visionOS.

The blast radius of the DarkSword chain is exceptionally broad, impacting almost every device in Apple’s current hardware lineup.

Because the initial infection vector relies entirely on how the device processes standard web content, victims can be compromised without downloading any visible files.

Simply visiting a compromised website or clicking a deceptive link is enough to trigger the first stage of the attack.

While it is currently unknown if these vulnerabilities are being used in ransomware campaigns, the deep kernel-level access they provide makes them highly attractive to advanced persistent threat groups looking to establish quiet, long-term persistence.

In response to the active exploitation of these flaws, CISA has placed a strict deadline on remediation.

Under Binding Operational Directive (BOD) 22-01, all federal agencies must apply the necessary mitigations provided by Apple no later than April 3, 2026.

While this directive officially applies only to government entities, CISA strongly advises private enterprises and individual consumers to prioritize these updates immediately.

Administrators should ensure all Apple devices are updated to the newest software versions.

If patches cannot be applied to specific systems, security teams are instructed to discontinue the use of those products to prevent potential network compromise.