CVE-2025-43300

The vulnerability (CWE-787) consists of a write error outside the permitted memory area during processing of a specially crafted image file. Insufficient bounds checking allows an attacker to perform controlled overwrites of process memory areas. Delivering a malicious file to the victim — for example via message, email, or website — may be sufficient to trigger the error without requiring user interaction beyond opening or viewing the file.

Successful exploitation of the vulnerability can lead to memory corruption, and consequently to arbitrary code execution (RCE) in the context of the attacked application or system. An attacker can gain full control over the device, including access to sensitive data, ability to compromise system integrity, and disruption of its availability.

Systems must be immediately updated to the following versions containing the patch: iOS 18.6.2 / iPadOS 18.6.2, iOS 16.7.12 / iPadOS 16.7.12, iOS 15.8.5 / iPadOS 15.8.5, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Details available in vendor references (support.apple.com).

iOS 15 before version 15.8.5, iOS 16 before version 16.7.12, iOS 17 (iPadOS) before version iPadOS 17.7.10, iOS 18 before version 18.6.2, iPadOS 15 before version 15.8.5, iPadOS 16 before version 16.7.12, iPadOS 18 before version 18.6.2, macOS Sequoia before version 15.6.1, macOS Sonoma before version 14.7.8, macOS Ventura before version 13.7.8

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.