Apple releases updates for actively exploited zero-day vulnerability in ImageIO framework
Take action: This one is important. If Apple thinks a single vulnerability is worth releasing new versions of iOS, iPadOS and macOS, you should consider the patch VERY IMPORTANT. Don't delay, update your devices, use the hour while they are updating for a short walk. Best for both you and computer.
Learn More
Apple has released emergency security updates to patch a zero-day vulnerability that has been actively exploited in targeted attacks.
The flaw is tracked as CVE-2025-43300 (no CVE assigned yet) and is an out-of-bounds write vulnerability in the Image I/O framework. Apple's ImageIO framework, is a core component that enables applications to read and write most common image file formats across iOS, iPadOS, and macOS systems. An out-of-bounds write occurs when attackers cause a program it to write data outside the allocated memory buffer, which can lead to memory corruption, program crashes, data corruption, or in the worst-case scenario, arbitrary code execution.
Apple acknowledged that they are "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals." Processing a malicious image file could result in memory corruption, potentially allowing attackers to gain unauthorized access to devices, execute surveillance, or compromise system integrity.
Affected devices include
- iPhone XS and later,
- iPad Pro 13-inch,
- iPad Pro 12.9-inch 3rd generation and later,
- iPad Pro 11-inch 1st generation and later,
- iPad Air 3rd generation and later,
- iPad 7th generation and later,
- iPad mini 5th generation and later.
- Mac computers running macOS Sequoia, macOS Sonoma, and macOS Ventura.
The patched versions are
- iOS 18.6.2 and iPadOS 18.6.2 for mobile devices,
- iPadOS 17.7.10 for older iPad models,
- macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8 for Mac computers.
Apple strongly recommends all users install the security updates immediately. The targeting nature of attacks means the exploit is used either by state sponsored attackers or government agencies. Either way, patching should be a priority.
Update - as of 16th of September 2025, Apple has released security updates to backport patches released last month to older iPhones and iPads. Apple has now addressed this zero-day flaw in iOS 15.8.5 / 16.7.12, as well as iPadOS 15.8.5 / 16.7.12
