CVE-2025-43300
Published: 21 August 2025
Summary
CVE-2025-43300 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Ipados. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 10.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
An out-of-bounds write vulnerability (CWE-787) exists in Apple's image processing code across multiple platforms. It affects iOS and iPadOS versions prior to 15.8.5, 16.7.12, 18.6.2, and 17.7.10, as well as macOS Ventura through 13.7.8, Sonoma through 14.7.8, and Sequoia through 15.6.1. The flaw allows memory corruption when a malicious image file is processed and carries a CVSS 3.1 score of 10.0.
An unauthenticated remote attacker can trigger the issue simply by supplying a crafted image that the victim device renders, achieving arbitrary memory corruption with full confidentiality, integrity, and availability impact. No user interaction beyond viewing or receiving the image is required.
Apple has released fixes in the versions listed above and published corresponding security advisories. The updates address the root cause through improved bounds checking.
Apple states it is aware of reporting that the vulnerability has been used in an extremely sophisticated attack against specific targeted individuals. The associated EPSS score remains low and essentially flat near 0.044.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25409
Vulnerability details
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura…
more
13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- CWE(s)
- KEV Date Added
- 21 August 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in image processing enables remote client-side RCE with no user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly mitigating CVE-2025-43300 by applying Apple's patches that fix the out-of-bounds write in image processing.
SI-10 enforces information input validation, addressing the root cause of CVE-2025-43300 through improved bounds checking on malicious image files to prevent memory corruption.
SI-16 provides memory protection mechanisms that mitigate exploitation of the out-of-bounds write in CVE-2025-43300 by preventing arbitrary code execution from memory corruption.