VulnRadar

Data against noise.

Built with NaN
Page generated: 11 Nov 2026, 14:16 UTC
← Dashboard

CVE-2025-43520

DarkSword

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may b…

Read full description
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
CVSS 5.5 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
4.3/10
REALITY · THREAT PRIORITY
7.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 5.5: +0.82
  • Fresh EPSS: 0.43%: +0.00

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 33 documents and public datasets.

Hype components

Headline sample (25%)
30/100
Press, 30 days (60%)
35/100
Grounded branding (15%)
100/100
HYPE TOTAL44/100

Sources and documents

Cyber Press
Press · 30 Oct 2026, 06:32 · Hackers Use Coruna and DarkSword Exploit Chains Across 608 Domains to Target iPhones - Cyber Press
CyberSecurityNews
Press · 29 Oct 2026, 07:00 · Hackers Use Zero-Click Coruna and DarkSword Exploits to Steal Sensitive Data From iPhones - CyberSecurityNews
TOKENPOST
Press · 19 Oct 2026, 07:00 · DarkSword Malware Is Used in Attacks Affecting Some iOS 26 Versions - TOKENPOST
Fox News
Press · 19 Oct 2026, 07:00 · New iPhone spyware can steal passwords and photos - Fox News
iVerify
Press · 13 Oct 2026, 07:00 · Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector - iVerify
See all 33 source documents
The Hacker News
Press · 11 Oct 2026, 07:00 · P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands - The Hacker News
Macworld
Press · 09 Oct 2026, 07:00 · DarkSword and Coruna iOS exploits continue to attack crypto wallets - Macworld
iVerify
Press · 08 Oct 2026, 07:00 · Sleep, Beacon, Steal, Repeat - The Story of P7 DarkSword Variant - iVerify
9to5Mac
Press · 08 Oct 2026, 07:00 · Researchers uncover new DarkSword spyware variant affecting unpatched iPhones - 9to5Mac
Malwarebytes
Press · 29 Sep 2026, 07:00 · Fake iPhone Duo preorder scam triggers DarkSword attack - Malwarebytes
Rescana
Press · 12 Aug 2026, 07:00 · Active Exploitation Alert: Coruna and DarkSword iOS Exploit Chains Target Apple Devices Globally - Rescana
The Hacker News
Press · 03 Aug 2026, 07:00 · Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - The Hacker News
Bitdefender
Press · 24 Apr 2026, 07:00 · ‘Update iOS to Protect Your Data’ – Apple Urges Users to Patch Against Coruna and DarkSword Exploits - Bitdefender
Kaspersky
Press · 17 Apr 2026, 07:00 · Hackers leverage leaked government intelligence tools to target everyday iOS users - Kaspersky
BleepingComputer
Press · 01 Apr 2026, 07:00 · Apple expands iOS 18 updates to more iPhones to block DarkSword attacks - BleepingComputer
SecurityWeek
Press · 30 Mar 2026, 07:00 · Russian APT Star Blizzard Adopts DarkSword iOS Exploit Kit - SecurityWeek
Lookout
Press · 25 Mar 2026, 07:00 · WebKit and Kernel Vulnerabilities and DarkSword Exploit | Threat Intel - Lookout
Mashable
Press · 24 Mar 2026, 16:47 · iPhone exploit DarkSword has been released in the wild: How to protect yourself - Mashable
BleepingComputer
Press · 23 Mar 2026, 07:00 · CISA orders feds to patch DarkSword iOS flaws exploited attacks - BleepingComputer
The Hacker News
Press · 21 Mar 2026, 07:00 · CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026 - The Hacker News
Cyber Magazine
Press · 20 Mar 2026, 07:00 · DarkSword Spyware: Is Your iPhone Watching You? - Cyber Magazine
Security Affairs
Press · 20 Mar 2026, 07:00 · Apple urges iPhone users to update as Coruna and DarkSword exploit kits emerge - Security Affairs
Malwarebytes
Press · 19 Mar 2026, 07:00 · [updated] A DarkSword hangs over unpatched iPhones - Malwarebytes
Zimperium
Press · 19 Mar 2026, 07:00 · DarkSword: The Hit-and-Run Successor to the Coruna iOS Exploit Kit - Zimperium
FoneArena.com
Press · 19 Mar 2026, 07:00 · DarkSword iOS exploit chain adopted by multiple threat actors: Report - FoneArena.com
Security Affairs
Press · 19 Mar 2026, 07:00 · DarkSword emerges as powerful iOS exploit tool in global attacks - Security Affairs
The Hacker News
Press · 19 Mar 2026, 07:00 · DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover - The Hacker News
SecurityWeek
Press · 18 Mar 2026, 07:00 · ‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors - SecurityWeek
Dark Reading
Press · 18 Mar 2026, 07:00 · DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike - Dark Reading
Google Cloud
Press · 18 Mar 2026, 07:00 · The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors - Google Cloud
Lookout
Press · 18 Mar 2026, 07:00 · Attackers Wielding DarkSword Threaten iOS Users | Threat Intel - Lookout
Lookout
Press · 18 Mar 2026, 07:00 · Lookout Uncovers DarkSword iOS Exploit Chain, Exposing a New Era of Mobile Threats - Lookout
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 05 Nov 2025, 08:00 · Apple Products Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.0Reality 7.808 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 4.3Reality 7.8Nov 2Nov 8

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
df2029/cs-build00C30 Oct 2026, 20:19
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 5.5; EPSS 0.4%
Attention, last 30 days
5 distinct story titles; 5 press documents; 1 publisher domains.
Technical potential
local access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-08 11:44:17.134663+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
05 Nov 2025, 08:00
Published
12 Dec 2025, 20:56
Added to the CISA KEV catalog
20 Mar 2026, 00:00
Latest press mention
30 Oct 2026, 06:32
Score calculated
08 Nov 2026, 11:44
Name
DarkSword
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar