CVE-2025-43300

9.5 CISA KEV

Apple · iOS, iPadOS, and macOS

A critical out-of-bounds write vulnerability in Apple iOS, iPadOS, and macOS allows memory corruption via malicious image processing, facilitating potential remote code execution.

Executive summary

This critical out-of-bounds write vulnerability in Apple operating systems is confirmed to be actively exploited in the wild, posing an immediate risk of system compromise.

Vulnerability

The flaw is an out-of-bounds write vulnerability triggered during the processing of a malicious image file, which results in memory corruption. The vulnerability is exploitable by an unauthenticated attacker.

Business impact

Successful exploitation of this vulnerability allows an attacker to achieve memory corruption, which can lead to arbitrary code execution on the target device. Given the CVSS score of 9.5, this represents a critical risk to organizational data confidentiality, integrity, and availability. Compromise of mobile and desktop endpoints could facilitate unauthorized access to sensitive corporate resources and internal communications.

Remediation

Immediate Action: Update all affected Apple devices to the latest versions: iOS and iPadOS 15.8.5, 16.7.12, 17.7.10, 18.6.2, or macOS 13.7.8, 14.7.8, 15.6.1, as appropriate for the specific OS version.

Proactive Monitoring: Monitor device logs for signs of unexpected application crashes or anomalous background processes that may indicate attempts to trigger memory corruption.

Compensating Controls: Ensure that users avoid opening untrusted or unsolicited image files from unknown sources, and maintain device security configurations that limit execution privileges where possible.

Exploitation status

Public Exploit Available: Yes, multiple public proofs-of-concept are available via GitHub repositories.

Analyst recommendation

The active exploitation of this vulnerability in the wild makes it a top-tier priority for security and IT teams. Organizations must initiate an immediate patching cycle across all fleet devices to mitigate the risk of remote code execution. Failure to apply these updates leaves systems vulnerable to advanced exploitation attempts that bypass standard security controls.

Look Back #18

A look back, with hindsight

Published 2026-08-18. Reviewed with sources that didn't exist at disclosure time.

Backstory

Apple shipped Image I/O as a standalone framework in Mac OS X 10.4. Apple's own programming guide records the split: "Originally part of the Core Graphics framework, Image I/O resides in its own framework to allow developers to use it independently of Core Graphics (Quartz 2D)," available "in OS X v10.4 and later and in iOS 4 and later." The goal was consolidation. Rather than have every application carry its own decoders, Apple offered one framework it called "the definitive way to access image data," covering "a wide range of image formats, including the standard web formats, high dynamic range images, and raw camera data." Anything that turns bytes into a picture, first-party or third-party, lands in that shared C code.

Google Project Zero measured the consequence in April 2020. Samuel Gross fuzzed roughly two dozen ImageIO formats, found six bugs in the framework and eight more in its bundled copy of OpenEXR, and described the reachability plainly: messenger code that decrypts and thumbnails an incoming attachment turns "Apple's UIImage image parsing and CoreGraphics image rendering code into 0click attack surface." His recommendation was to restrict receivers to a small number of formats.

The RAW surface grew instead. Apple's camera compatibility list names hundreds of models across Canon, Nikon, Sony, Panasonic, Olympus, Leica and Pentax, and adds "basic support for RAW files in DNG (Digital Negative) format, even when captured by cameras not listed here." DNG is Adobe's TIFF/EP-derived container, and its raw payload may be compressed with lossless Huffman JPEG. That nests one parser inside another, and it lets the same fact be stated twice.

CVE-2025-43300 lives in that duplication. Quarkslab's patch analysis places the bug in the RawCamera component of ImageIO.framework, in a class named CDNGLosslessJpegUnpacker, where the TIFF subdirectory declared a SamplesPerPixel of 2 while the embedded JPEG SOF3 marker declared one component. The decode loop trusted the container: "the condition of the loop over the pixels is wrong: i < width*2 assumes there are only 2 components." Apple's advisory of 20 August 2025 describes the fix in one sentence: "An out-of-bounds write issue was addressed with improved bounds checking."

Apple's platform mitigations bracket this path without covering it. BlastDoor, introduced in iOS 14, sandboxes iMessage attachment parsing and does not extend to third-party messengers. Lockdown Mode, from iOS 16, blocks "most message attachment types, other than certain images, video, and audio." Memory Integrity Enforcement, announced on 9 September 2025, addresses the bug class rather than the format: Apple wrote that mercenary spyware chains against iOS "share a common denominator with those targeting Windows and Android: they exploit memory safety vulnerabilities."

Technical analysis (revisited)

The bug class is CWE-787, an out-of-bounds write in a RAW image decoder that is reached without user interaction. The original analyst comment had the class right and nothing else about the mechanism, because nothing about the mechanism was public on the day it was written.

Two independent patch analyses now describe it. Quarkslab published a diff of Apple's fix on 4 September 2025 and located the flaw in RawCamera's lossless-JPEG decompression path rather than in ImageIO's JPEG or HEIF code. A DNG file carries its sample count in two places: SamplesPerPixel in the TIFF image file directory, and NumComponents in the header of the embedded SOF3 lossless-JPEG stream. The write routine advanced the destination pointer from the container's value, two bytes per 16-bit sample, while the loop bound came from the JPEG stream's value. Declare 2 in one and 1 in the other and every decoded row writes twice its allocation. The hackyboiz collective reached the same conclusion independently in October 2025, naming CDNGLosslessJpegUnpacker and confirming that the trigger is metadata inconsistency alone: no unusual pixel data is required. Apple's patch retrieves the destination buffer size and raises an exception instead of writing past it.

That root cause sets the cost of building a trigger. A working proof of concept was published on 22 August 2025, one day after the NVD entry appeared, and the input is an otherwise legitimate DNG with two altered metadata bytes.

Two record-level facts have also moved. Apple published no CVSS score for this CVE. The original note recorded 8.8; NVD now shows 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) after CISA's ADP program revised the record on 26 February 2026, following a community request (vulnrichment issue #201) whose supporting claims, an iMessage HEIF-to-ASTC chain and a Lockdown Mode bypass, are corroborated by no vendor or forensic source. The note also recorded the vendor as "An Multiple Products", a parsing artifact of the advisory sentence beginning "An out-of-bounds write issue"; the affected component is Apple ImageIO, and the remedy Apple offers is the OS update, with no workaround or mitigation listed.

Lifecycle timeline

2025-04-16: CVE-2025-43300 reserved at MITRE (source)
2025-08-20: Apple advisories published, component ImageIO, self-credited "CVE-2025-43300: Apple" (source)
2025-08-20: Patch released: iOS 18.6.2 and iPadOS 18.6.2 (source)
2025-08-20: Patch released: iPadOS 17.7.10 (source)
2025-08-20: Patch released: macOS Sequoia 15.6.1 (source)
2025-08-20: Patch released: macOS Sonoma 14.7.8 (source)
2025-08-20: Patch released: macOS Ventura 13.7.8 (source)
2025-08-20: Tenable Nessus plugins published (253051, 253052, 253055, 253056) (source)
2025-08-21: NVD entry published, CWE-787 (source)
2025-08-21: CISA KEV added (source)
2025-08-21: Qualys detections published (QIDs 610726, 610727, 384607, 384608, 384609) (source)
2025-08-22: First public proof of concept published (source)
2025-08-29: WhatsApp advisory published for the chained CVE-2025-55177, naming CVE-2025-43300 (source)
2025-08-29: Amnesty International Security Lab statement on targeted users (source)
2025-09-02: CISA KEV adds the chained CVE-2025-55177 (WhatsApp) (source)
2025-09-04: Quarkslab publishes the public root-cause patch analysis (source)
2025-09-09: Apple announces Memory Integrity Enforcement (source)
2025-09-11: CISA KEV remediation deadline (source)
2025-09-15: Backport released: iOS 16.7.12 and iPadOS 16.7.12 (source)
2025-09-15: Backport released: iOS 15.8.5 and iPadOS 15.8.5 (source)
2025-09-15: Tenable Nessus plugins published for the backport trains (264810, 264825) (source)
2025-10-23: Independent root-cause confirmation naming CDNGLosslessJpegUnpacker (source)
2026-02-26: CISA ADP revises the CVSS score to 10.0 (source)
2026-03-05: Google Threat Intelligence Group groups the CVE into a DNG-parsing exploitation family (source)
2026-06-17: NVD entry last modified (source)

Real-world outcome

Apple's exploitation statement is the standard mercenary-spyware formula: it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals." Apple credited itself for the CVE and named no external reporter, which is unusual for a spyware-chain zero-day, where Citizen Lab or Amnesty normally appears in the credit line.

The delivery path came from Meta, not Apple. WhatsApp's advisory for CVE-2025-55177, published on 29 August 2025, describes "incomplete authorization of linked device synchronization messages" that "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device," and states that this, "in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users." Those two sentences are the whole zero-click. The WhatsApp flaw gets a file fetched and parsed with no tap; the ImageIO flaw turns the parse into memory corruption.

On the same day, Donncha O Cearbhaill, head of Amnesty International's Security Lab, said WhatsApp had sent threat notifications to people it believed were targeted in the preceding 90 days, and urged recipients to seek forensic help. Amnesty characterised the campaign as reaching civil society, journalists and other at-risk profiles. The scale figure circulating at the time, fewer than 200 notified users, was relayed through press rather than published by Meta or Amnesty. Twelve months on, no dedicated forensic report or indicator set for this campaign has appeared on Amnesty's Security Lab site, and no operator has been publicly named.

The original CVE Brief note, dated 21 August 2025, recorded the active exploitation and the KEV listing on the day both happened. It described the delivery as crafted data sent to a network-reachable product; the path documented eight days later was a linked-device sync message inside a messaging application.

Lessons

A single shared decoder makes format support into attack surface, and the surface is set by the most obscure format the framework will accept. Project Zero named that in 2020 and recommended shrinking it. The DNG path that carried this bug is available on every iPhone, iPad and Mac regardless of whether the owner has ever opened a RAW file, and Apple's own compatibility page states that DNG works even for cameras absent from the list.

This case also shows what happens when a file format states the same fact twice. Neither the TIFF SamplesPerPixel value nor the JPEG NumComponents value was wrong on its own; they only disagreed, and one routine read each. Apple did not fix that by reconciling the two declarations. It added a size check on the write, which holds regardless of which future pair of fields turns out to be able to disagree.

Sandbox coverage here is per-application, not per-parser. BlastDoor isolates iMessage attachment parsing and the chain ran through WhatsApp, reaching the same system decoder outside it.

The pattern is not confined to Apple. Google's 2025 zero-day retrospective places CVE-2025-43300 alongside the Samsung Quram bugs CVE-2025-21042 and CVE-2025-21043 as sharing "identical exploitation conditions", and observes that the heap-spraying primitives are "more or less inherent to the DNG format", which is what lets a single memory-corruption bug become a zero-click ASLR bypass. The same report records that in 2025, for the first time, commercial surveillance vendors were attributed more zero-day exploitation than state-sponsored groups.

References

More Apple CVEs all →

History

Aug 21, 2025 Disclosed CVE record published
Aug 21, 2025 Published in the daily brief high section
Aug 22, 2025 Published in the daily brief high section
Aug 23, 2025 Published in the daily brief kev section
Aug 24, 2025 Published in the daily brief kev section
Aug 25, 2025 Published in the daily brief kev section
Aug 26, 2025 Published in the daily brief kev section
Aug 27, 2025 Published in the daily brief kev section
Aug 28, 2025 Published in the daily brief kev section
Aug 29, 2025 Published in the daily brief kev section
Aug 30, 2025 Published in the daily brief kev section
Sep 2, 2025 Published in the daily brief kev section
Sep 3, 2025 Published in the daily brief kev section
Sep 4, 2025 Published in the daily brief kev section
Sep 5, 2025 Published in the daily brief kev section
Sep 6, 2025 Published in the daily brief kev section
Sep 7, 2025 Published in the daily brief kev section
Sep 8, 2025 Published in the daily brief kev section
Sep 9, 2025 Published in the daily brief kev section
Sep 10, 2025 Published in the daily brief kev section
Sep 11, 2025 Published in the daily brief kev section
Aug 18, 2026 Look Back published
Aug 29, 2026 Analyst report written
Sep 7, 2026 Fix documented version 15.8.5 per CVE record

CVE Brief Security Intelligence