CVE-2025-43300

What it actually does

This is an out-of-bounds write memory-corruption vulnerability in Apple iOS, iPadOS, and macOS image processing. When a malicious image file is parsed, vulnerable code can write outside the intended memory buffer, potentially causing application crashes, arbitrary code execution, sandbox escape, or device compromise depending on exploit reliability and the process handling the image. Because image parsing can be triggered by common workflows such as messaging, web browsing, email, previews, thumbnails, or document rendering, exposure may exist even when the user does not intentionally open an attachment.

Why it matters to the business

Successful exploitation can give an attacker access to sensitive data, communications, files, credentials, location information, camera or microphone data, and other device-resident information. Apple has reported exploitation in highly sophisticated targeted attacks, and the vulnerability is listed in CISA KEV with a remediation deadline of 2025-09-11, making rapid patching especially important for executives, legal teams, journalists, administrators, developers, and other high-value users. Operationally, unpatched iPhones, iPads, and Macs may represent a high-risk path for espionage, data theft, and persistence in environments that rely on Apple endpoints.

How an attack unfolds

An attacker prepares a specially crafted image designed to trigger the out-of-bounds write when processed by vulnerable Apple image-handling components. The image is then delivered through a channel that causes automatic or user-initiated parsing, such as a message, email, web page, shared file, document, or application content. Once the device or application processes the image, memory corruption occurs. A mature exploit can use that corruption to redirect execution flow, run attacker-controlled code in the context of the parsing process, and potentially chain additional vulnerabilities to escape sandboxes, elevate privileges, implant spyware, or extract sensitive data. Reported exploitation has been associated with highly targeted, sophisticated activity rather than broad commodity ransomware campaigns.

How to fix it

Upgrade affected Apple devices to the fixed releases or later: iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8. Prioritize devices used by high-risk users and devices that handle sensitive communications or administrative access. Where immediate patching is not possible, reduce exposure by limiting unsolicited attachments and links, disabling automatic preview behavior where feasible, using Lockdown Mode for high-risk Apple users, restricting unmanaged messaging or file-sharing apps, and enforcing MDM compliance rules that block access from devices below fixed versions.

How to confirm the fix worked

Confirm that all Apple endpoints report an OS version at or above the relevant fixed release for their major version. Use MDM inventory, endpoint management, or local checks such as iOS/iPadOS Settings > General > About and macOS System Settings > General > About, or command-line validation on macOS with `sw_vers`. Validate that update enforcement policies mark older versions as noncompliant and that blocked or quarantined devices cannot access sensitive services. For high-risk users, review whether Lockdown Mode and reduced attachment/link handling controls are enabled where appropriate.

Typical attack path

1. Identify a target using an affected iOS, iPadOS, or macOS version.
2. Craft or obtain a malicious image file that triggers the vulnerable image-processing path.
3. Deliver the image through a message, email, website, shared document, or app workflow likely to be processed by the device.
4. Trigger image parsing through preview generation, rendering, indexing, or user interaction.
5. Exploit the out-of-bounds write to corrupt memory and gain code execution in the affected process.
6. Chain with additional exploit steps if needed to bypass sandboxing or gain higher privileges.
7. Deploy spyware, collect sensitive data, access communications, or maintain stealthy presence on the device.

How to detect it

There are no broadly reliable public indicators that uniquely identify exploitation of this vulnerability. Detection should focus on signs of targeted mobile or macOS compromise and suspicious image-processing activity. Review MDM, EDR, unified logs, crash reports, browser history, messaging/email telemetry, and network security logs for unexpected crashes or resets around the time unsolicited images, links, messages, shared albums, or documents were received. On macOS, inspect `/Library/Logs/DiagnosticReports`, `~/Library/Logs/DiagnosticReports`, unified logs, quarantine events, browser download records, email attachment caches, and suspicious child processes spawned by image-rendering, messaging, mail, browser, or preview components. On iOS and iPadOS, collect sysdiagnose data, analytics/crash logs, MDM security events, and application logs where available. Look for repeated crashes involving image, graphics, preview, messaging, mail, browser, or media parsing components; unexpected network connections shortly after image receipt; new profiles, certificates, VPN configurations, or device-management changes; unexplained battery drain or overheating; and evidence of spyware-like persistence or data exfiltration. Because exploitation has been described as extremely sophisticated and targeted, absence of obvious logs does not prove non-exploitation; suspected cases should be handled with mobile forensics and preservation of device state.

What your security team should do

• Treat this as an emergency patching item because it is in CISA KEV, has reported in-the-wild exploitation, and affects widely deployed Apple endpoint platforms.
• Inventory all iOS, iPadOS, and macOS devices and identify any below the fixed versions listed by Apple.
• Patch or isolate vulnerable devices, prioritizing executives, administrators, legal, finance, security staff, developers, journalists, and other likely targeted users.
• Use MDM compliance policies to block corporate access from devices that have not reached fixed versions.
• Advise high-risk users to avoid unsolicited image attachments, links, shared albums, documents, and messages until devices are patched.
• Enable or recommend Apple Lockdown Mode for users at elevated risk of targeted spyware activity.
• Collect and preserve crash logs and endpoint telemetry from suspected targeted devices before wiping or reimaging.
• Escalate suspicious cases involving unexpected image-related crashes, unusual device behavior, or high-risk targeting to incident response and, where appropriate, a mobile forensics specialist.