CVE-2025-43300

Exploited in the wild. In CISA KEV since 2025‑08‑21. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile99th65% chance in 30 days CISA KEVListedsince 2025-08-21, due 2025-09-11
Public exploit: 1 source Fix3 products7 fixed builds listed below

Published 2025-08-21Updated 2025-11-26Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple macOSAffected: < 13.7.8Upgrade to: 13.7.8Affected: < 14.7.8Upgrade to: 14.7.8Affected: < 15.6.1Upgrade to: 15.6.1Stated by: CVE record
Apple iPadOSAffected: < 17.7.10Upgrade to: 17.7.10Stated by: CVE record
Apple iOS and iPadOSAffected: < 15.8.5Upgrade to: 15.8.5Affected: < 16.7.12Upgrade to: 16.7.12Affected: < 18.6.2Upgrade to: 18.6.2Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

On each Apple device, open Settings or System Settings > General > Software Update and check its installed version.
Update iPhone and iPad devices to iOS/iPadOS 15.8.5, 16.7.12, 17.7.10, or 18.6.2, as applicable.
Update Mac computers to macOS 13.7.8, 14.7.8, or 15.6.1, as applicable.
Prioritize company-owned devices that receive images through messaging, email, or web apps.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Exploitation reported in the wild
as reported · Sep 29, 2026·Dark Reading summary
Added to CISA KEV catalog
Aug 21, 2025·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

In plain language

Written by AI from the record

CVE-2025-43300 is a flaw in Apple iOS, iPadOS, and macOS that can let a malicious image take control of an unpatched device; update devices below iOS/iPadOS 15.8.5, 16.7.12, 17.7.10, or 18.6.2, and macOS 13.7.8, 14.7.8, or 15.6.1 now.

Unauthenticated remote code execution through an out-of-bounds write in Apple ImageIO when a device processes a crafted image file.

If you're affected

Device takeover
Business data exposure
Ransomware risk
Service disruption

What is it

This is a mistake in the part of Apple software that handles image files. A booby-trapped image can make the device put information in the wrong place, like forcing a key into the wrong lock until the door mechanism breaks and an intruder gains control.

Who is affected

This matters to you if your business uses or manages Apple iOS, iPadOS, or macOS devices. It is a risk when a device processes a malicious image file; the attacker does not need a login or user approval.

How urgent is it

Attackers are already exploiting this vulnerability in zero-click attacks, including attacks linked with a WhatsApp vulnerability against fewer than 200 targeted users. Treat this as urgent: CISA added it to its known-exploited list and set September 11, 2025 as the remediation deadline for covered U.S. federal agencies.

What to do — in detail

Confirm exposure by inventorying managed iPhone, iPad, and Mac versions and comparing them with Apple’s fixed releases. Target iOS/iPadOS 15.8.5 for the 15 branch, 16.7.12 for the 16 branch, 17.7.10 for the 17 branch, and 18.6.2 for the 18 branch; target macOS 13.7.8, 14.7.8, or 15.6.1 for the corresponding macOS branch.

Use normal Apple software-update deployment and test critical business apps on a representative device if your organization controls update rollout. If patching must be delayed, isolate affected devices from untrusted image delivery paths where feasible, restrict use of unneeded messaging apps, and prioritize devices used by executives or staff handling sensitive information.

For organizations subject to CISA KEV requirements, the stated remediation due date was 2025-09-11. After updating, verify installed versions in device management records and investigate unusual crashes or suspicious activity involving image-processing, messaging, or browser applications.

Technical context

CVE-2025-43300 is rated CVSS 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is CWE-787, an out-of-bounds write. A crafted image processed by ImageIO can cause memory corruption and enable remote code execution without authentication or user interaction. Exploitation has been reported in zero-click campaigns alongside CVE-2025-55177, and a public GitHub proof of concept is known. Its inclusion in CISA’s Known Exploited Vulnerabilities catalog indicates confirmed real-world exploitation and requires prioritized remediation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2025-08-21.

US federal agencies must remediate by 2025-09-11.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

65% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

The patch came 100 days before any public exploit.

2026-10-25EPSS band changemoderate → highepss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changelow → moderate
2026-03-07Public exploit / PoCsource: github-poc
2025-11-26Patch availablerecord updated
2025-08-21Added to CISA KEVpublished, weakness classified, att&ck mapped

Affected products

Apple Inc.commercial · USaka apple, apple computer
- MacOSOSOn-premOperating Systems / unix-bsd
- iPadOSOSEmbeddedOperating Systems / mobile-os
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable