Apple fixed a dyld flaw possibly exploited against targeted users

What happened

Apple fixed a memory corruption flaw in dyld, the part of iOS that loads app code, in iOS and iPadOS 26.3. Apple said it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.

An attacker who can already write to memory may be able to run arbitrary code.

What was found

Google's Threat Analysis Group reported the flaw. Apple issued two WebKit fixes, CVE-2025-14174 and CVE-2025-43529, in response to the same report, and Google later listed this flaw in the DarkSword exploit chain. Apple has not published attack details.

Data at risk

• Not disclosed by Apple

What you should do

1. 1Update to iOS or iPadOS 26.3 or later.
2. 2Keep automatic updates turned on.