Apple released security updates to fix CVE-2025-43300, an out-of-bounds write vulnerability in the ImageIO framework that can cause memory corruption when processing crafted images. The vulnerability has reportedly been exploited in highly sophisticated, targeted attacks against specific individuals. Apple says the bug was discovered internally and was remediated with improved bounds checking. Patches cover multiple iOS, iPadOS, and macOS releases, including iOS/iPadOS 18.6.2, iPadOS 17.7.10, and macOS Ventura, Sonoma, and Sequoia updates. This fix brings the year-to-date total to seven zero-days patched after real-world abuse, and follows a recent Safari patch for CVE-2025-6558.
The zero-day out-of-bounds write vulnerability, tracked as CVE-2025-43300, resides in the ImageIO framework that could result in memory corruption when processing a malicious image. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals," the company said in an advisory. The iPhone maker said the bug was internally discovered and that it was addressed with improved bounds checking.
iOS 18.6.2 and iPadOS 18.6.2 - iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later iPadOS 17.7.10 - iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation macOS Ventura 13.7.8 - Macs running macOS Ventura macOS Sonoma 14.7.8 - Macs running macOS Sonoma macOS Sequoia 15.6.1 - Macs running macOS Sequoia
With the latest update, Apple has so far fixed a total of seven zero-days that have been abused in real-world attacks since the start of the year: CVE-2025-24085, CVE-2025-24200, CVE-2025-24201, CVE-2025-31200, CVE-2025-31201, and CVE-2025-43200. Last month, the company also issued patches for a Safari vulnerability residing in an open-source component (CVE-2025-6558) that Google reported as having been exploited as a zero-day in the Chrome web browser.
Collection
[
|
...
]