WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users

WhatsApp has disclosed a zero-day vulnerability, tracked as CVE-2025-55177, that was exploited in highly targeted attacks against Apple users and described as an incomplete authorization of linked device synchronization messages. An attacker could have exploited the issue to trigger the processing of content from arbitrary URLs on victims’ devices, according to WhatsApp’s advisory, and the vulnerability was combined with an OS-level flaw (CVE-2025-43300) that Apple has patched.

The OS flaw affects the ImageIO framework across iOS, iPadOS and macOS, with patches issued in iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8 and macOS Ventura 13.7.8. WhatsApp states that it patched CVE-2025-55177 in July and August in WhatsApp for iOS and WhatsApp Business for iOS, and in WhatsApp for Mac, but did not share details of the observed attacks.

Roughly 200 potentially targeted individuals were notified, and Amnesty International’s Donncha Ó Cearbhaill commented that the security defects were chained in zero-click attacks as part of a suspected spyware campaign. The story, published on 2 September 2025, underscores the risk to both iPhone and Android users, including journalists and human rights defenders, from sophisticated government spyware.