Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks

Summary: Apple released security updates for iOS, iPadOS, and macOS to fix CVE-2025-43300, an out-of-bounds write in the ImageIO framework (CVSS 8.8) that can cause memory corruption when processing a malicious image. Apple said the bug was internally discovered, was addressed with improved bounds checking, and may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Bottom line: This is the seventh Apple zero-day abused in real-world attacks since the start of the year, and Apple has not identified who is behind the campaign or who was targeted - a malicious image is enough to trigger it.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-24085 CVE-2025-24200 CVE-2025-24201 CVE-2025-31200 CVE-2025-31201 CVE-2025-43200 CVE-2025-43300 CVE-2025-6558
Related: Apple Issues Security Updates After Two Web Kit Flaws Found Exploited in the Wild Cyber Risks ·
CVE-2025-43300: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Aug 21, 2025
CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jul 22, 2025