Malicious Image Files Trigger Memory Corruption: Apple Critical Zero-Day vulnerability CVE-2025-43300
CVE-2025-43300 is a critical zero-day vulnerability in Apple's ImageIO framework that has been actively exploited in sophisticated targeted attacks. The flaw carries a CVSS score of 8.8 and affects iOS, iPadOS, and macOS devices.
Technical Details
The vulnerability is an out-of-bounds write issue in the ImageIO framework, which handles image processing across Apple platforms. When an application processes a malicious image file, it triggers memory corruption that allows attackers to write code to parts of memory they shouldn't access. This enables attackers to execute arbitrary code with elevated privileges and potentially achieve persistent access to the device.
Apple acknowledged that this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals". The company discovered the flaw internally and addressed it with improved bounds checking
Affected Systems
The vulnerability impacts a wide range of Apple devices:
iOS and iPadOS:
-
iPhone XS and later models
-
iPad Pro (various generations from 1st gen 11-inch and 3rd gen 12.9-inch onward)
-
iPad Air 3rd generation and later
-
iPad 7th generation and later
-
iPad mini 5th generation and later
macOS:
-
macOS Sequoia (prior to 15.6.1)
-
macOS Sonoma (prior to 14.7.8)
-
macOS Ventura (prior to 13.7.8)
Security Updates
Apple released patches on August 19-20, 2025 in the following versions:
-
iOS 18.6.2 and iPadOS 18.6.2
-
iPadOS 17.7.10 (for older iPad models)
-
macOS Sequoia 15.6.1
-
macOS Sonoma 14.7.8
-
macOS Ventura 13.7.8
Government Response
CISA has added CVE-2025-43300 to its Known Exploited Vulnerabilities Catalog and mandated that federal agencies patch their systems by September 11, 2025. This marks the seventh zero-day vulnerability that Apple has patched in 2025, highlighting an escalating trend in active exploitation of Apple platforms.
Security experts recommend immediate updates for all users, as historically, targeted zero-day exploits often evolve into broader attack campaigns once patches are publicly available