Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks
Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks
To fix a security vulnerability affecting iOS, iPadOS, and macOS that it claims has been actively exploited in the wild, Apple has published security upgrades.
The ImageIO framework contains a zero-day out-of-bounds write vulnerability known as CVE-2025-43300 (CVSS score: 8.8) that may cause memory corruption when processing a malicious image.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals,” an alert from the firm stated.
According to the iPhone manufacturer, the flaw was found internally and fixed with enhanced bounds checking. The security flaw is fixed in the following versions:
| iOS 18.6.2 and iPadOS 18.6.2 | iPad Air 3rd generation and later, iPad 7th generation and later, iPad mini 5th generation and later, iPad Pro 13-inch, iPad Pro 12.9-inch, iPad Pro 12.9-inch, iPad Pro 11-inch, and iPhone XS and later |
| iPadOS 17.7.10 | Second-generation iPad Pro 12.9-inch, first-generation iPad Pro 10.5-inch, and sixth-generation iPad |
| macOS Ventura 13.7.8 | Macs running macOS Ventura |
| macOS Sonoma 14.7.8 | Macs running macOS Sonoma |
| macOS Sequoia 15.6.1 | Macs running macOS Sequoia |
Although the attackers and potential targets are unknown at this time, it is likely that the vulnerability has been used as a component of highly targeted attacks.
Since the beginning of the year, Apple has patched seven zero-day vulnerabilities with the most recent update: CVE-2025-24085, CVE-2025-24200, CVE-2025-24201, CVE-2025-31200, CVE-2025-31201, and CVE-2025-43200.
Additionally, the business released remedies last month for a Safari vulnerability (CVE-2025-6558) that was found to have been exploited as a zero-day in the Chrome web browser, according to Google.
About The Author:
Yogesh Naager is a content marketer who specializes in the cybersecurity and B2B space. Besides writing for the News4Hackers blogs, he also writes for brands including Craw Security, Bytecode Security, and NASSCOM.
Read More:
Weak Passwords and Compromised Accounts: Discoveries in Blue Report 2025
About Author
English