CVE-2025-43300

KEVApple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Description

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

PublishedAug 21, 2025

Last modifiedJun 17, 2026

Added to KEVAug 21, 2025

Remediation dueSep 11, 2025

References

support.apple.com/en-us/124925Release NotesVendor Advisory
support.apple.com/en-us/124926Release NotesVendor Advisory
support.apple.com/en-us/124927Release NotesVendor Advisory
support.apple.com/en-us/124928Release NotesVendor Advisory
support.apple.com/en-us/124929Release NotesVendor Advisory
support.apple.com/en-us/125141Release NotesVendor Advisory
support.apple.com/en-us/125142Release NotesVendor Advisory
seclists.org/fulldisclosure/2025/Sep/10Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Sep/14Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Sep/52Mailing ListThird Party Advisory
github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.mdExploitThird Party Advisory
github.com/cisagov/vulnrichment/issues/201Issue Tracking

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 410 days
CVSS: 10.0 CRITICAL
EPSS (30-day exploit probability): 65.2% · top 1% of all CVEs
Weakness: CWE-787
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.