CVE-2025-43300

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-43300 10.0

Apple · iOS, iPadOS, and macOS · Added 2025-08-21 · Published 2025-08-21

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityApple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

VendorApple

ProductiOS, iPadOS, and macOS

Date added2025-08-21

Due date2025-09-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.

NVD: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-18 01:02 UTC

Wall time120s

Searches11

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-43300
https://support.apple.com/en-us/124925
https://support.apple.com/en-us/124927
https://blog.quarkslab.com/patch-analysis-of-Apple-iOS-CVE-2025-43300.html
https://fidelissecurity.com/vulnerabilities/cve-2025-43300/
https://www.secpod.com/blog/apple-fixes-cve-2025-43300-zero-day-protect-your-ios-ipados-macos-now
https://github.com/PwnToday/CVE-2025-43300
https://github.com/hunters-sec/CVE-2025-43300
https://github.com/7amzahard/CVE-2025-43300
https://www.malwarebytes.com/blog/news/2025/08/all-apple-users-should-update-after-company-patches-zero-day-vulnerability-in-all-platforms
https://socprime.com/blog/cve-2025-43300-zero-day-vulnerability/
https://www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-new-actively-exploited-zero-day/

Hunting hypothesis agent

Hunt macOS and iOS crash logs for ImageIO/RawCamera.bundle SIGSEGV/EXC_BAD_ACCESS after DNG file receipt via Messages, Mail, or AirDrop, indicating a SamplesPerPixel versus SOF3 component-count mismatch in the JPEG Lossless decoder.

Research details

ComponentImageIO framework's RawCamera.bundle JPEG Lossless decompression code handling DNG/TIFF image processing

PreconditionsTarget must be running a vulnerable version of Apple iOS (15.8.5/16.7.12/18.6.2), iPadOS (15.8.5/16.7.12/17.7.10/18.6.2), or macOS (Ventura 13.7.8/Sonoma 14.7.8/Sequoia 15.6.1); attacker must deliver a maliciously crafted DNG image file to the target; user interaction required to open or process the image via any application that utilizes the ImageIO framework (e.g., Messages, Mail, Safari, Photos); no network reachability needed for exploitation once the image is delivered. agent

Deliveryfile-parsing

Public PoCyes

PoC URLs https://github.com/PwnToday/CVE-2025-43300
https://github.com/hunters-sec/CVE-2025-43300
https://github.com/7amzahard/CVE-2025-43300 Third-party repos; verify before use.

Advisoryhttps://support.apple.com/en-us/124925

Exploit notesCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL severity (10.0) - Attack complexity LOW, no privileges required, no user interaction required per CVSS vector; practical exploitation involves delivering a crafted DNG image via Messages, email, or web download; multiple public PoCs available on GitHub confirm exploitability.

SummaryCVE-2025-43300 is a critical out-of-bounds write vulnerability (CWE-787) in Apple's ImageIO framework, specifically within the RawCamera.bundle JPEG Lossless decompression code that processes DNG/TIFF images. Successful exploitation via a maliciously crafted image file leads to memory corruption and arbitrary code execution on affected iOS, iPadOS, and macOS devices. Apple has confirmed this vulnerability was exploited in extremely sophisticated targeted attacks, and CISA has added it to the Known Exploited Vulnerabilities catalog.

Tia coverage

First reported2026-05-27

First exploit report2026-05-27

Exploit report → KEV279 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

apple-patches-coregraphics-out-of-bounds-write-cve-2026-86950 zero-click-whatsapp-account-takeover-cve-2025-43300-cve-2025-551

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.