by Kastro
Paper/Archive/CVE-2025-43300

CVE-2025-43300

Apple iOS and iPadOS — Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

KEV · due 11 SepEPSS 65%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (ADP)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.3.993 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Affected

ProductAffectedFixed inSource
iOS and iPadOS< 15.8.515.8.5CNA
iOS and iPadOS< 16.7.1216.7.12CNA
iOS and iPadOS< 18.6.218.6.2CNA
iPadOS< 17.7.1017.7.10CNA
macOS< 13.7.813.7.8CNA
macOS< 14.7.814.7.8CNA
macOS< 15.6.115.6.1CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/124925refsupport.apple.com/en-us/124926refsupport.apple.com/en-us/124927refsupport.apple.com/en-us/124928refsupport.apple.com/en-us/124929refsupport.apple.com/en-us/125141refsupport.apple.com/en-us/125142refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300refgithub.com/cisagov/vulnrichment/issues/201refgithub.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.mdrefseclists.org/fulldisclosure/2025/Sep/52refseclists.org/fulldisclosure/2025/Sep/14refseclists.org/fulldisclosure/2025/Sep/10kevcisa.gov/known-exploited-vulnerabilities-catalog