WhatsApp Issues Emergency Update for Zero-Click Exploit Targeting iOS and macOS Devices

WhatsApp has issued an emergency update for zero-click exploits believed to have been used against iOS and macOS devices, linked to a recently disclosed Apple flaw in targeted zero‑day attacks. According to Apple, CVE-2025-43300 is an out-of-bounds write in the ImageIO framework that could enable memory corruption when processing a malicious image, and CVE-2025-55177 relates to insufficient authorisation of linked device synchronization messages with a CVSS of 8.0.

The vulnerabilities were found in WhatsApp for iOS prior to 2.25.21.73, WhatsApp Business for iOS 2.25.21.78, and WhatsApp for Mac 2.25.21[.]78, and have been connected to a broader targeted campaign affecting specific individuals, with Amnesty International’ s Donncha Ó Cearbhaill noting notifications to several people in the past 90 days.

The alert advises those targeted to perform a full device factory reset and keep both their operating system and WhatsApp up to date, though it remains unclear who is behind the spyware involved.