CVE-2025-24091

CVE-2025-24091 is a vulnerability in iOS that leverages the "Darwin notification" system. This vulnerability allows any application, even those with sandbox restrictions, to trigger an unrecoverable "restore in progress" state on the device with a single line of code. The issue stems from the lack of sender verification or privilege gating in the Darwin notifications API, which enables a third-party app to send critical system-level notifications. A proof-of-concept app called "EvilNotify" demonstrated the vulnerability by using the `notify_post("com.apple.MobileSync.BackupAgent.RestoreStarted")` function call. This tricks the system into thinking a device restore is underway, freezing user interactions and requiring a device restart. Furthermore, embedding this exploit in a widget extension can cause a persistent loop, effectively "soft-bricking" the phone until a full device erase and restore from backup is performed. The vulnerability is addressed in iOS/iPadOS 18.3.