Apple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware Attack

Apple on Monday backported fixes for CVE-2025-43300, a memory‑corruption risk in ImageIO that could occur when processing a malicious image file and has a CVSS score of 8.8, the article notes.

According to The Hacker News, Apple is aware of a report that this issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals.” The piece also states that WhatsApp acknowledged a vulnerability in its iOS and macOS apps (CVE-2025-55177) had been chained with CVE-2025-43300 in highly targeted spyware attacks affecting fewer than 200 individuals.

Although Apple initially addressed the flaw late last month with iOS 18.6.2 and related updates, the article lists additional releases for older versions, including iOS 16.7.12 and iOS 15.8.5, among others, and notes the updates were rolled out alongside a wide range of OS versions such as iOS 26 and macOS Sonoma 14.8. The piece emphasises that while there is no evidence of real‑world weaponisation for the listed flaws, keeping systems up‑to‑date remains good practice.