CISA Alerts Users to Active Exploitation of 0-Day Vulnerability in Apple iOS, iPadOS, and macOS
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical zero-day vulnerability, tracked as CVE-2025-43300, affecting Apple’s iOS, iPadOS, and macOS operating systems. This vulnerability, which allows code execution through maliciously crafted images, is actively being exploited by threat actors. CISA has added CVE-2025-43300 to its Known Exploited Vulnerabilities (KEV) catalog, indicating that immediate action is required from both organisations and individual users to safeguard their systems. Apple has released security updates to address this vulnerability, and users are urged to install these updates without delay. Federal agencies have a mandatory remediation deadline of September 11, 2025, under Binding Operational Directive (BOD) 22-01, which requires them to apply vendor-supplied mitigations or discontinue the use of affected products if patches are unavailable.
The vulnerability represents an out-of-bounds write flaw within Apple’s Image I/O framework, classified under CWE-787. This type of weakness allows attackers to write data beyond the intended boundaries of allocated memory buffers, potentially leading to arbitrary code execution, system crashes, or privilege escalation. The Image I/O framework is widely used for processing various image formats, including JPEG, PNG, and HEIF files, making this vulnerability particularly concerning. Security researchers have indicated that the flaw can be triggered through maliciously crafted image files, enabling attackers to execute arbitrary code with the privileges of the affected application. Given the broad attack surface affecting iPhones, iPads, and Mac computers, CISA’s swift response highlights the severity of the situation, emphasising the need for immediate attention from network defenders and cybersecurity teams.
Categories: Cybersecurity, Vulnerability Management, Software Updates
Tags: CVE-2025-43300, Zero-Day Vulnerability, Apple, iOS, iPadOS, macOS, Out-of-Bounds Write, Image I/O, Security Updates, Arbitrary Code Execution