iVerify-Nickname-Vulnerability-Report.pdf

iVerify discovered and analyzed a previously unknown iMessage vulnerability ("NICKNAME") in the imagent service that caused Use-After-Free memory corruption when mutable nickname dictionaries were concurrently accessed; telemetry and forensic evidence suggest targeted, zero-click exploitation against high-risk individuals in the US and EU. The issue was patched in iOS 18.3 by broadcasting immutable copies of nickname dictionaries; affected users should update immediately and high-risk users should enable additional mitigations like Lockdown Mode.