Apple backports fix for actively exploited CVE-2025-43300

Apple has backported patches for a recently addressed actively exploited vulnerability tracked as CVE-2025-43300, which affects iOS, iPadOS and macOS. In August 2025, Apple fixed an out-of-bounds write flaw in the ImageIO framework after reports that it was being exploited in targeted attacks, with Apple describing that processing a malicious image could cause memory corruption.

According to Apple, the updates include iOS 18.6.2 and iPadOS 18.6.2 for newer devices, iPadOS 17.7.10 for older iPad models, macOS Ventura 13.7.8, macOS Sonoma 14.7.8 and macOS Sequoia 15.6.1, plus older iOS and iPadOS releases such as iOS 16.7.12 and iPadOS 16.7.12, and iOS 15.8.5 and iPadOS 15.8.5 for older devices.

WhatsApp has confirmed that attackers chained CVE-2025-55177 with CVE-2025-43300 in spyware campaigns targeting fewer than 200 people, and Apple’s patches were released across recent iOS, iPadOS and macOS updates. As usual, Apple did not share technical details about the attacks exploiting this vulnerability.