Apple has issued critical security updates to patch CVE-2025-43300, a significant vulnerability found in the ImageIO framework. This flaw has been exploited in sophisticated spyware attacks targeting fewer than 200 individuals. The vulnerability allows memory corruption through specially crafted image files, a consequence of insufficient bounds validation during image processing.
The exploitation of this vulnerability has been part of high-profile targeted campaigns that reportedly include chaining with a WhatsApp vulnerability (CVE-2025-55177) by commercial surveillanceware vendors. The reach of these targeted attacks extends to both newer and older Apple devices, with similar exploits recognized on Samsung Android devices, indicating a coordinated effort against users of both platforms.
In response, Apple delivered emergency security updates for iOS 16.7.12 and iPadOS 16.7.12, along with backported fixes to older operating systems, specifically iOS 16.7.12 and iOS 15.8.5, and iPadOS 15.8.5 to safeguard end-of-life devices like the iPhone 8, iPad 5th generation, iPhone 6s, iPhone 7, iPhone SE (1st gen), iPad Air 2, iPad mini (4th gen), and iPod touch (7th gen).
This update not only addresses CVE-2025-43300 but also resolves 14 additional security vulnerabilities across multiple components including Safari, WebKit, and system services. Apple’s decision to include older devices in these patches underscores the severity of the situation and the company’s commitment to security, urging all users to update their devices promptly to mitigate potential risks from these sophisticated threats.

Collections

Apple released emergency security updates to fix CVE-2025-43300, a critical ImageIO vulnerability exploited in targeted spyware attacks affecting fewer than 200 individuals. The flaw allows memory corruption through malicious image files and was used alongside WhatsApp exploits by commercial surveillance vendors. Updates cover iOS 16.7.12, iPadOS 16.7.12, and backported fixes for older devices, addressing 15 total vulnerabilities across Safari, WebKit, and system services.

Apple Backports Fix for CVE-2025-43300 Following Targeted Spyware Attacks