How to Report iOS 12 Security Vulnerabilities

This article outlines the official channels and protocols available for security researchers and users to report vulnerabilities found in iOS 12. Although iOS 12 is an older operating system primarily running on legacy hardware like the iPhone 5s and iPhone 6, Apple still maintains active security reporting mechanisms to evaluate potential threats, fix critical exploits, and protect users still operating older devices.

1. The Apple Security Research Portal

The primary and most efficient method to report an iOS 12 vulnerability to Apple is through the official Apple Security Research web portal at security.apple.com.

  • Submission Process: Sign in with an Apple ID to open a new vulnerability report.
  • Tracking: The portal allows researchers to track the status of their submitted issues in real-time, communicate directly with Apple engineers, and request updates.
  • Apple Security Bounty: While bounty rewards primarily target the latest operating systems, vulnerabilities discovered in iOS 12 that also affect current iOS versions or represent critical cross-version flaws can be evaluated through this system.

2. Apple Product Security Email

For researchers who prefer not to use the web portal, or who encounter issues with it, Apple accepts vulnerability submissions directly via email.

  • Address: Send reports to product-security@apple.com.
  • PGP Encryption: Apple strongly encourages encrypting sensitive vulnerability details. Researchers should use the official Apple Product Security PGP Key, available on Apple's official support website, to encrypt the message body and any attached proof-of-concept exploits.
  • Auto-acknowledgment: Senders typically receive an automated confirmation containing a tracking identifier within a short time.

3. Required Information to Include

To ensure the Apple Product Security team can triage and reproduce the issue on iOS 12, submissions should contain:

  • Specific Target: Clearly state the exact iOS 12 build version (e.g., iOS 12.5.7) and the specific hardware model used (e.g., iPhone 6).
  • Vulnerability Category: Define the vulnerability type (e.g., Remote Code Execution, Kernel Memory Corruption, Sandbox Escape, or Cross-Site Scripting in WebKit).
  • Technical Details: Provide a clear description of the behavior, root cause analysis if known, and crash logs or system diagnostics.
  • Proof of Concept (PoC): Include step-by-step reproduction instructions, scripts, or demonstration code.

4. Third-Party Reporting Mechanisms

If direct disclosure with Apple is not preferred or requires external mediation, third-party coordinators can facilitate the reporting process:

  • CERT Coordination Center (CERT/CC): Researchers can submit vulnerabilities through the CERT/CC vulnerability reporting form, which coordinates responsible disclosure between the finder and Apple.
  • Zero Day Initiative (ZDI): Researchers seeking third-party acquisition or coordinated disclosure can submit qualifying iOS vulnerabilities to the Trend Micro Zero Day Initiative.