Apple has launched security updates to deal with a security flaw impacting iOS, iPadOS, and macOS that it mentioned has come below lively exploitation within the wild.
The zero-day out-of-bounds write vulnerability, tracked as CVE-2025-43300, resides within the ImageIO framework that would lead to reminiscence corruption when processing a malicious picture.
“Apple is conscious of a report that this difficulty could have been exploited in a particularly refined assault towards particular focused people,” the corporate mentioned in an advisory.
The iPhone maker mentioned the bug was internally found and that it was addressed with improved bounds checking. The next variations tackle the security defect –
- iOS 18.6.2 and iPadOS 18.6.2 – iPhone XS and later, iPad Professional 13-inch, iPad Professional 12.9-inch third technology and later, iPad Professional 11-inch 1st technology and later, iPad Air third technology and later, iPad seventh technology and later, and iPad mini fifth technology and later
- iPadOS 17.7.10 – iPad Professional 12.9-inch 2nd technology, iPad Professional 10.5-inch, and iPad sixth technology
- macOS Ventura 13.7.8 – Macs working macOS Ventura
- macOS Sonoma 14.7.8 – Macs working macOS Sonoma
- macOS Sequoia 15.6.1 – Macs working macOS Sequoia
It is at the moment not identified who’s behind the assaults and who could have been focused, nevertheless it’s doubtless that the vulnerability has been weaponised as a part of extremely focused assaults.
With the newest replace, Apple has thus far fastened a complete of seven zero-days which have been abused in real-world assaults because the begin of the yr: CVE-2025-24085, CVE-2025-24200, CVE-2025-24201, CVE-2025-31200, CVE-2025-31201, and CVE-2025-43200.
Final month, the corporate additionally issued patches for a Safari vulnerability residing in an open-source element (CVE-2025-6558) that Google reported as having been exploited as a zero-day within the Chrome internet browser.
