CVE-2025-43300: Apple patches a critical zero-day exploited in targeted attacks

Apple has just released emergency security updates to fix CVE-2025-43300, a critical zero-day vulnerability in the ImageIO framework. The flaw was actively exploited in “extremely sophisticated” attacks targeting specific individuals, making it the seventh zero-day Apple has patched since the start of 2025.

Technical details of CVE-2025-43300

CVE-2025-43300 is an out-of-bounds write vulnerability affecting Apple’s Image I/O framework, an essential component responsible for processing image formats on iOS, iPadOS and macOS. The flaw allows attackers to corrupt system memory by processing a malicious image file.

The Image I/O framework handles opening, decoding and displaying image files across Apple’s operating systems. When an application processes an image exploiting this CVE, the vulnerability triggers memory corruption that allows arbitrary code to run with elevated privileges.

Exploitation in sophisticated attacks

Apple confirmed that CVE-2025-43300 was exploited in an “extremely sophisticated attack against specific targeted individuals”. This wording strongly suggests the involvement of advanced threat actors, possibly nation states or commercial spyware vendors such as NSO Group.

These attacks probably rely on spear-phishing techniques, sending malicious images to targets via email, messaging apps or social networks. The ease of exploitation makes this method particularly dangerous: a single image file is enough to fully compromise a device.

Devices affected by CVE-2025-43300

This vulnerability affects a wide range of Apple devices. On mobile, CVE-2025-43300 affects the iPhone XS and later, as well as many iPad models including iPad Pro, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later.

On desktop, CVE-2025-43300 is fixed in macOS Sequoia 15.6.1, macOS Sonoma 14.7.8 and macOS Ventura 13.7.8, covering practically every Mac still in service. This broad scope means millions of users worldwide are potentially vulnerable.

The alarming context of Apple zero-days in 2025

CVE-2025-43300 represents a worrying statistic: the seventh zero-day patched by Apple since January 2025. Previous vulnerabilities include CVE-2025-24085 in January, CVE-2025-24200 in February, CVE-2025-24201 in March, and CVE-2025-31200 and CVE-2025-31201 in April.

This pace already exceeds the 2024 total, when Apple patched six zero-days over the whole year. The acceleration reflects malicious actors’ intensifying efforts against the Apple ecosystem, particularly in state and commercial espionage operations.

Apple’s response and available patches for CVE-2025-43300

Apple reacted quickly by releasing emergency patches in iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8 and macOS Ventura 13.7.8. The company fixed the vulnerability by improving bounds checking in the Image I/O framework.

In line with its usual policy, Apple does not disclose the technical details of the exploitation, the identity of the attackers or the profile of the victims. This approach aims to protect users by not making it easier for other cybercriminals to reproduce the attacks.

Urgent recommendations for users

All Apple users should install the available updates immediately, even though the documented attacks remain highly targeted. History shows that exploitation techniques often spread to broader campaigns once the details are revealed.

High-risk users (journalists, activists, lawyers, diplomats) should consider enabling Apple’s Lockdown Mode, which disables many potentially exploitable features. It is also wise to be particularly careful with images received from unknown sources by email or message.

Conclusion

CVE-2025-43300 perfectly illustrates the changing threat landscape facing the Apple ecosystem. This zero-day vulnerability, the seventh of the year, shows how sophisticated actors are stepping up efforts to compromise Apple devices in targeted espionage operations.

Apple’s fast response is encouraging, but the growing frequency of these incidents underlines the need for constant vigilance and a proactive approach to security for all users of the Apple ecosystem.

---

Frequently asked questions