CRITICAL

CVE-2025-43300

Apple Ipados 2025-08-21 CVSS v3.1

CVSS

KEV

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Summary dbcve.org

Out-of-bounds write vulnerability in image processing components of iOS, iPadOS, and macOS. Processing a maliciously crafted image file leads to memory corruption, potentially allowing arbitrary code execution.

Mitigation

Apply Apple's security updates (iOS 15.8.5+, iOS 16.7.12+, iOS 17.7.10+, iOS 18.6.2+; macOS Ventura 13.7.8+, Sonoma 14.7.8+, Sequoia 15.6.1+) to all affected devices immediately, prioritizing high-value targets given the reported targeted exploitation.

Proof of Concept

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

21.99%

Probability of exploitation in next 30 days

97.6th percentile

References

https://support.apple.com/en-us/124925 Release Notes, Vendor Advisory https://support.apple.com/en-us/124926 Release Notes, Vendor Advisory https://support.apple.com/en-us/124927 Release Notes, Vendor Advisory https://support.apple.com/en-us/124928 Release Notes, Vendor Advisory https://support.apple.com/en-us/124929 Release Notes, Vendor Advisory https://support.apple.com/en-us/125141 Release Notes, Vendor Advisory https://support.apple.com/en-us/125142 Release Notes, Vendor Advisory http://seclists.org/fulldisclosure/2025/Sep/10 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2025/Sep/14 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2025/Sep/52 Mailing List, Third Party Advisory https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md Exploit, Third Party Advisory https://github.com/cisagov/vulnrichment/issues/201 Issue Tracking https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE