# Apple Patches Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks

Source: https://thehackernews.com/2025/08/apple-patches-cve-2025-43300-zero-day.html?m=1
Kiwi News: https://news.kiwistand.com/stories/Apple-Patches-Zero-Day-in-iOS-iPadOS-and-macOS-Exploited-in-Targeted-Attacks?index=0x68a962a96fa50bceada63f23b64b3e15ee3f6ab7777e2998f9e209a783cde7290b28f559
Submitted by misha on 2025-08-23 UTC, 13 upvotes, 0 comments

## Summary

Apple has released security updates for iOS, iPadOS, and macOS to fix a zero-day vulnerability that it says has been actively exploited in the wild. The flaw, tracked as CVE-2025-43300 with a CVSS score of 8.8, is an out-of-bounds write in the ImageIO framework that can cause memory corruption when a malicious image is processed. Apple said it was aware of a report that the issue may have been used in an extremely sophisticated attack against specific targeted individuals, and that it was fixed with improved bounds checking. With this update, Apple has fixed seven zero-days exploited in real-world attacks so far this year.

## Article

Apple has released security updates to address a security flaw impacting iOS, iPadOS, and macOS that it said has come under active exploitation in the wild.

The zero-day out-of-bounds write vulnerability, tracked as CVE-2025-43300 (CVSS score: 8.8), resides in the ImageIO framework and could result in memory corruption when processing a malicious image.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals," the company said in an advisory.

The iPhone maker said the bug was internally discovered and that it was addressed with improved bounds checking. The following versions address the security defect -

iOS 18.6.2 and iPadOS 18.6.2 - iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later

iPadOS 17.7.10 - iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation

macOS Ventura 13.7.8 - Macs running macOS Ventura

macOS Sonoma 14.7.8 - Macs running macOS Sonoma

macOS Sequoia 15.6.1 - Macs running macOS Sequoia

It's currently not known who is behind the attacks and who may have been targeted, but it's likely that the vulnerability has been weaponised as part of highly targeted attacks.

With the latest update, Apple has so far fixed a total of seven zero-days that have been abused in real-world attacks since the start of the year: CVE-2025-24085, CVE-2025-24200, CVE-2025-24201, CVE-2025-31200, CVE-2025-31201, and CVE-2025-43200.

Last month, the company also issued patches for a Safari vulnerability residing in an open-source component (CVE-2025-6558) that Google reported as having been exploited as a zero-day in the Chrome web browser.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.