CVE-2025-43300: Zero-Day in Apple Image I/O Exploited in Targeted Attacks

CVE-2025-43300: Zero-Day in Apple Image I/O Exploited in Targeted Attacks

Summary

CVE-2025-43300 is a critical zero-day vulnerability in Apple’s Image I/O framework affecting iOS, iPadOS, and macOS. First seen on August 20, 2025, this out-of-bounds write flaw allows attackers to execute arbitrary code by delivering a maliciously crafted image file. Apple has confirmed active exploitation in targeted attacks, making it a high-risk cybersecurity threat. Patches have been released in iOS 18.6.2, iPadOS 18.6.2/17.7.10, and macOS Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8. Users must update immediately to secure their devices.

Vulnerability Details

The Apple Image I/O zero-day vulnerability (CVE-2025-43300) can be exploited with little or no user interaction, enabling potential zero-click attacks. Simply receiving or previewing a crafted image could compromise an iPhone, iPad, or Mac. The flaw corrupts memory and gives attackers the ability to execute malicious code, escalating the risk of widespread exploitation if unpatched.

Affected versions include:

• macOS: All releases prior to Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8

• iOS/iPadOS: All releases prior to iOS 18.6.2 and iPadOS 18.6.2/17.7.10

The vulnerability is classified under CWE-787 (Out-of-Bounds Write) and linked to the following CPEs:

• cpe:2.3:o:apple:ipados

• cpe:2.3:o:apple:iphone_os

• cpe:2.3:o:apple:macos

Recommendations

1. Update Devices Immediately – Install Apple’s latest patches (iOS 18.6.2, iPadOS 18.6.2/17.7.10, macOS Sequoia 15.6.1, Sonoma 14.7.8, Ventura 13.7.8).

2. Enable Automatic Updates – Ensure automatic updates are turned on to minimize exposure.

3. Exercise Caution with Images and Media – Avoid opening unsolicited images or media files from untrusted sources, as this vulnerability can trigger on preview.

4. Prioritize High-Risk Devices – Immediately patch devices handling sensitive data or belonging to executives and high-value targets.

MITRE ATT&CK TTPs

• Tactics:

  • Execution (TA0002)

  • Resource Development (TA0042)

  • Initial Access (TA0001)

  • Privilege Escalation (TA0004)

  • Impact (TA0040)

• Techniques:

  • Exploitation for Privilege Escalation (T1068)

  • Exploit Public-Facing Application (T1190)

  • Exploitation for Client Execution (T1203)

  • Command and Scripting Interpreter (T1059)

  • Obtain Capabilities (T1588)

  • Exploits (T1588.005)

  • Vulnerabilities (T1588.006)

References

• Apple Security Update – iOS 18.6.2

• Apple Security Update – iPadOS 18.6.2/17.7.10

• Apple Security Update – macOS Sequoia 15.6.1

• Apple Security Update – macOS Sonoma 14.7.8

• Apple Security Update – macOS Ventura 13.7.8

• Qualys Advisory on CVE-2025-43300