CVE-2025-43300criticalunder attackCWE-787

CVE-2025-43300: critical vulnerability in Apple iPadOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 10epss 65%
from disclosure to weapon1 day
Published on NVDAug 21
1st PoC+1d
CISA KEVAug 21
Action required by CISAfederal deadline: 2025-09-11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in image file processing allows attackers to write data beyond allocated memory boundaries, potentially corrupting system memory. This critical vulnerability affects Apple devices and can be exploited remotely through malicious image files.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in image processing code lacks proper bounds validation. Attack vector involves crafting a malicious image file that triggers memory corruption when processed; no user interaction complexity is required. Impact includes arbitrary code execution with full system privileges; real-world exploitation has been confirmed against targeted users.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · iPadOSApple · macOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple iPadOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEVCVE-2023-28205HIGHCVE-2023-28205EPSS 27.1%KEV