CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Description
CVE-2025-43300 is a critical out-of-bounds write vulnerability in Apple iOS, iPadOS, and macOS that can be triggered by processing a malicious image file, resulting in memory corruption and potentially arbitrary code execution. With the maximum CVSS v3.1 base score of 10.0, this vulnerability requires no authentication or user interaction and can affect resources beyond the vulnerable component. Apple has confirmed that CVE-2025-43300 may have been exploited in an extremely sophisticated attack against specific targeted individuals, potentially in combination with CVE-2025-55177, a WhatsApp authorization bypass vulnerability. CISA has added CVE-2025-43300 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 11, 2025, and its EPSS score of 0.69% at the 71st percentile reflects the highly targeted nature of the exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.8.5; >= 16.0, < 16.7.12; >= 17.0, < 17.7.10; >= 18.0, < 18.6.2 |
| apple | iphone os | < 15.8.5; >= 16.0, < 16.7.12; >= 17.0, < 18.6.2 |
| apple | macos | >= 13.0, < 13.7.8; >= 14.0, < 14.7.8; >= 15.0, < 15.6.1 |
References
- https://support.apple.com/en-us/124925(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124926(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124927(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124928(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124929(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125141(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125142(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Sep/10(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Sep/14(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Sep/52(Mailing List, Third Party Advisory)
- https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md(Exploit, Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/201(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CVE-2025-43300 is classified under CWE-787 (Out-of-bounds Write). This weakness occurs when software writes data past the end or before the beginning of an intended buffer, corrupting adjacent memory. In Apple's image processing subsystem, parsing a maliciously crafted image file triggers a write beyond the allocated buffer bounds, enabling memory corruption that can be leveraged for arbitrary code execution. Out-of-bounds write vulnerabilities are consistently ranked as the most dangerous software weakness due to their direct path to code execution.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2025-43300 represents the maximum possible severity with a perfect CVSS score of 10.0. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). Critically, the scope is changed (S:C), meaning exploitation can affect resources beyond the vulnerable image processing component. Confidentiality (High): Successful exploitation grants the attacker access to all data on the device, including messages, photos, contacts, location data, credentials stored in the keychain, and data from all installed applications. Integrity (High): The attacker can install persistent implants, modify system files, and manipulate application data without the user's knowledge. Availability (High): Full device compromise enables the attacker to render the device unusable, wipe data, or maintain persistent control. The fact that Apple explicitly acknowledged exploitation "in an extremely sophisticated attack against specific targeted individuals" indicates involvement of advanced threat actors, likely commercial spyware vendors or state-sponsored groups, making this a critical priority for individuals in high-risk categories including journalists, activists, diplomats, and executives.
Exploit Maturity
CVE-2025-43300 has been exploited in real-world attacks. Apple has confirmed in its advisory that this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals." Public exploit information is available via a technical analysis on GitHub that documents the vulnerability details. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 11, 2025. The EPSS score of 0.69% at the 71st percentile appears relatively low but is consistent with the highly targeted nature of the exploitation, as sophisticated spyware campaigns target a small number of high-value individuals rather than conducting mass exploitation. When combined with CVE-2025-55177 (a WhatsApp linked device authorization bypass), the attacker can remotely trigger the target's device to process a malicious image through WhatsApp's URL handling, achieving zero-click exploitation without any action by the victim.
Remediation
-
Update all Apple devices immediately. Install iOS 15.8.5, iPadOS 15.8.5, iOS 16.7.12, iPadOS 16.7.12, iOS 18.6.2, iPadOS 18.6.2, or macOS 13.7.8 or later. Apple's security advisories at HT125141 and HT125142 provide update instructions.
-
Enable Lockdown Mode for high-risk users. Apple's Lockdown Mode significantly reduces the attack surface by limiting image processing, link previews, and other features commonly targeted by sophisticated exploits. Journalists, activists, diplomats, and other potential targets of state-sponsored surveillance should enable this feature.
-
Update WhatsApp. Since CVE-2025-43300 was exploited in combination with CVE-2025-55177 (a WhatsApp vulnerability), ensure WhatsApp for iOS is updated to v2.25.21.73 or later, and WhatsApp for Mac to v2.25.21.78 or later.
-
Assess potential compromise for targeted individuals. If you are in a high-risk category and were running a vulnerable Apple OS version, consider engaging a mobile forensics specialist to examine your device for indicators of spyware compromise. Look for unusual battery drain, unexpected data usage, or devices running warm when idle.
-
Implement organizational mobile device management. Organizations with high-risk personnel should enforce automatic OS updates through MDM policies, deploy Lockdown Mode to high-risk devices, and implement network monitoring to detect anomalous traffic from mobile devices.
Technical Details
CVE-2025-43300 is an out-of-bounds write vulnerability in Apple's image processing subsystem across iOS, iPadOS, and macOS. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H represents the maximum severity profile with changed scope, indicating the vulnerability's impact extends beyond the image processing component to the entire operating system. The vulnerability exists in the bounds checking logic of an image parser. When a specially crafted image file is processed, the parser fails to properly validate dimensions or data offsets, causing a write operation to exceed the allocated buffer's boundaries. This out-of-bounds write corrupts adjacent memory structures, which a sophisticated attacker can leverage through heap grooming techniques to achieve reliable arbitrary code execution. The changed scope (S:C) reflects that exploitation escapes the image processing sandbox and affects the broader operating system. Affected versions include iOS and iPadOS prior to 15.8.5, iOS and iPadOS 16.x prior to 16.7.12, iOS and iPadOS 18.x prior to 18.6.2, and macOS prior to 13.7.8. Apple's fix implements improved bounds checking to prevent the buffer overflow condition.
Frequently Asked Questions
Is CVE-2025-43300 being actively exploited?
Yes. Apple has confirmed that CVE-2025-43300 may have been exploited in an extremely sophisticated attack against specific targeted individuals. CISA has added it to the Known Exploited Vulnerabilities catalog. The attack was combined with a WhatsApp vulnerability (CVE-2025-55177) for remote exploitation.
What products are affected by CVE-2025-43300?
Apple iOS prior to 15.8.5 and 16.7.12, iPadOS prior to 15.8.5 and 16.7.12, iOS and iPadOS 18.x prior to 18.6.2, and macOS prior to 13.7.8 are affected. The vulnerability is in the image processing subsystem shared across Apple platforms.
How do I fix CVE-2025-43300?
Update to the latest iOS, iPadOS, or macOS version immediately. High-risk users should also enable Apple's Lockdown Mode and update WhatsApp to the latest version. If you suspect compromise, consult a mobile forensics specialist.
How severe is CVE-2025-43300?
CVE-2025-43300 has the maximum CVSS v3.1 base score of 10.0 (Critical severity). It enables remote code execution through a malicious image file with no authentication or user interaction required. The changed scope means exploitation can compromise the entire device, not just the image processing component.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.