A firmware-level security nightmare is unfolding across millions of Apple devices worldwide. Trusted by governments, cybersecurity professionals, and enterprise organizations to protect sensitive data, these systems are now exposed to a sophisticated attack vector that bypasses the critical code-signing protections at the heart of iOS, iPadOS, and macOS. Dubbed a zero-day of the highest order, CVE-2025-43300—with a CVSS v3.1 score of 8.8—targets Apple’s ImageIO framework, allowing attackers to execute arbitrary code, escalate privileges, and achieve device persistence by exploiting a simple malicious image file.

Vulnerability Details

• CVE-2025-43300: An out-of-bounds write vulnerability in Apple’s ImageIO framework, supporting the reading and writing of image files across macOS, iOS, and iPadOS. Attackers weaponize this flaw by processing malicious images, triggering memory corruption that allows arbitrary code execution and potential sandbox escape—even bypassing essential code-signing enforcement within the kernel.

Attack Scenarios & Impact

The exploitation potential of CVE-2025-43300 is alarming:

• Silent initial access: A simple image attachment sent via messaging, email, or web results in out-of-bounds memory manipulation, granting attackers device control in moments.
• Privileged code execution: Attackers bypass Apple’s kernel-level code-signing restrictions, enabling arbitrary code execution within system memory and escalating privileges from userland to kernel space.
• Persistence: Kernel exploits allow attackers to maintain long-term, stealthy access, surviving OS updates and hiding malicious implants deep within the device.
• Targeted espionage: Security experts revealed that CVE-2025-43300 has already been used in highly focused attacks—likely by nation-state actors and sophisticated cybercriminals, with government, technology, and defense sectors listed as probable targets.

Known TTPs (Tactics, Techniques, and Procedures)

CVE-2025-43300 aligns with attacker methodologies mapped to the MITRE ATT&CK framework:

• TA0001: Initial Access – Malicious images deliver device compromise.
• TA0004: Privilege Escalation – Bypassing kernel controls.
• T1055: Process Injection for stealthy persistence.
• T1543: Create/Modify System Process for long-term implants.
• TA0006: Credential Access – Potential theft of sensitive credentials stored on the device.
• TA0003: Persistence – Maintaining covert control even after reboots and updates.

Threat Actors & Real-World Exploitation

• Active APT exploitation: Groups such as APT-X1 and Cozy Bear (APT29) are reported to leverage CVE-2025-43300 in targeted campaigns—demonstrating advanced techniques, supply chain attacks, and spear-phishing to deploy the exploit.
• In-the-wild attacks: CISA added CVE-2025-43300 to its Known Exploited Vulnerabilities Catalog and urged urgent remediation by September 11, 2025.

Affected Devices

A wide range of Apple products are impacted:

Device	Vulnerable Versions
iPhone XS and later	Prior to iOS 18.6.2
iPad 7th generation and later	Prior to iPadOS 18.6.2, 17.7.10
iPad Air 3rd generation and later	Prior to iPadOS 18.6.2, 17.7.10
iPad mini 5th generation and later	Prior to iPadOS 18.6.2, 17.7.10
MacOS Sequoia	Prior to 15.6.1
MacOS Sonoma	Prior to 14.7.8
MacOS Ventura	Prior to 13.7.8
iPad Pro (various generations)	Prior to iPadOS 18.6.2, 17.7.10
iPad 6th generation	Prior to iPadOS 18.6.2, 17.7.10

Mitigation & Recommendations

Apple has taken swift action to issue security patches addressing CVE-2025-43300:

• Update all devices immediately. Install macOS Sonoma 14.7.8, macOS Ventura 13.7.8, macOS Sequoia 15.6.1, iPadOS 17.7.10, and iOS/iPadOS 18.6.2. Earlier versions are vulnerable to active exploitation.
• Continuous monitoring: Employ advanced endpoint detection and response systems, review kernel logs, hunt for IOCs (network traffic, file hashes, C2 domains), and maintain proactive threat intelligence feeds.
• Access controls & hardening: Enforce strict access policies to prevent adversary lateral movement, and use behavioral analysis for kernel event anomalies.
• Educate users: Raise awareness about the risks of malicious files, especially image attachments received through email or messaging apps.
• Patch management tools: Adopt solutions like Saner Patch Management for automated, accurate patch deployment across large Apple fleets, as well as safe rollback and testing features.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.