Apple has released emergency security updates to address CVE-2025-43300, a zero-day vulnerability located within its ImageIO framework. This flaw, an out-of-bounds write issue, affects iOS, iPadOS, and macOS, posing substantial risk as it can enable memory corruption through the processing of malicious image files. Apple acknowledges that these attacks appear to be extraordinarily sophisticated, with implications suggesting involvement of nation-state actors or commercial spyware vendors, such as groups like NSO Group and Paragon Solutions, known for their targeting operations.
The vulnerability has been actively exploited in targeted attacks, specifically against select individuals, prompting Apple to act swiftly. The company’s security team is credited with discovering the vulnerability and implementing bounds checking fixes across all the affected platforms’ latest versions. Importantly, this marks the seventh zero-day vulnerability Apple has addressed in this calendar year due to its exploitation in real-world scenarios.
Users running iOS, iPadOS, and macOS are urged to update their systems promptly to mitigate this critical security issue. The release of these updates underlines the continuous security threats faced by users and highlights the vital role of timely patching in safeguarding devices against sophisticated cyber threats.

Collections

Apple released emergency security updates to fix CVE-2025-43300, a zero-day vulnerability in the ImageIO framework affecting iOS, iPadOS, and macOS. The out-of-bounds write flaw enables memory corruption through malicious image files and has been actively exploited in sophisticated attacks, likely by nation-state actors or commercial spyware vendors. This marks Apple's seventh zero-day patch this year, emphasizing the critical need for users to update their devices immediately.

Apple Patches CVE-2025-43300 Zero-Day Vulnerability Exploited in Sophisticated Attacks