Apple has fixed a privilege escalation flaw in its Core Media framework that was used by hackers to attack iPhones running older versions of iOS.

As part of this batch of software updates, Apple also released several patches fixing security bugs, including a zero-day bug that “may have been actively exploited” — meaning hackers were using it to compromise devices — against users with iPhones running software older than iOS 17.2, which was released in December 2023.

The use-after-free flaw allows privilege escalation in affected media applications running on Apple’s Core Media framework.