Apple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware Attack
Summary: Apple backported fixes for CVE-2025-43300, a CVSS 8.8 out-of-bounds write in the ImageIO component that can cause memory corruption when processing a malicious image file, after first addressing it in iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Ventura 13.7.8, macOS Sonoma 14.7.8, and macOS Sequoia 15.6.1. WhatsApp acknowledged that CVE-2025-55177 (CVSS 5.4) in its iOS and macOS apps was chained with CVE-2025-43300 in highly targeted spyware attacks aimed at fewer than 200 individuals.
What's compelling: Fewer than 200 people were targeted, but the chain paired a messaging-app flaw with an image-processing bug that Apple says was used in an extremely sophisticated attack against specific individuals - the kind of targeting that rarely stays confined to its first victims.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-43300CVE-2025-55177
- Related