CVE-2015-1157

Vulnerability

CVE-2015-1157 is a denial-of-service vulnerability in Apple's CoreText framework on iOS versions 8.0 through 8.3 [2]. The bug is triggered when the system attempts to display a notification banner for an incoming message that contains a specific sequence of Arabic Unicode characters. The truncation logic in the notification rendering fails to handle the text correctly, causing a memory corruption that leads to a kernel panic and immediate device reboot [1][4]. The issue affects the Messages app and any application that displays CoreText-rendered notifications for incoming messages, such as WhatsApp [4].

Exploitation

An attacker needs only the ability to send an SMS message or a WhatsApp message to the targeted device [4]. No authentication, user interaction beyond receiving the message, or special network position is required. The attacker crafts a message containing a particular Arabic character sequence. When the recipient's device receives the message and attempts to display a notification banner (assuming banner notifications are enabled for the messaging app), the CoreText truncation routine processes the invalid Unicode sequence, leading to the crash [4]. The device reboots immediately and may experience a brief disruption in messaging services [4].

Impact

Successful exploitation causes a denial of service: the iPhone or iPad kernel panics and reboots [4]. The device is temporarily unavailable, and ongoing messaging sessions are disrupted. The vulnerability does not allow code execution or persistent data corruption; the impact is limited to a temporary service interruption until the device finishes rebooting [4].

Mitigation

Apple addressed CVE-2015-1157 in iOS 8.4, released on June 30, 2015 [2]. The fix is also included in OS X Yosemite v10.10.4 and Security Update 2015-005 [1], and in iTunes 12.3 for Windows [3]. Users should update all affected Apple devices to the latest available software. As a temporary workaround before patching, users can disable banner notifications for the Messages app in iOS Settings > Notifications [4]. The vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.