{"id":"CVE-2025-43300","published":"2025-08-21T01:15:36Z","modified":"2026-06-17T09:23:42Z","title":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability","vendor":"Apple","product":"iOS, iPadOS, and macOS","tier":"core","eol":null,"description":{"text":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.","provenance":"source","from":"NVD"},"summary":{"text":"An out-of-bounds write flaw in the Apple iOS, iPadOS, and macOS operating systems allows memory corruption when a malicious image file is processed. An attacker can exploit it over the network without authentication or user interaction beyond the image being processed, with no special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:58Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.65159,"percentile":0.99251,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-08-21","dueDate":"2025-09-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.apple.com/en-us/124925 ; https://support.apple.com/en-us/124926 ; https://support.apple.com/en-us/124927 ; https://support.apple.com/en-us/124928 ; https://support.apple.com/en-us/124929 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43300","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-20","exploitedFirstSeen":"2025-08-20","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-08-20"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43300","date":"2025-08-20"},{"url":"https://support.apple.com/en-us/124925","date":"2025-08-20"},{"url":"https://support.apple.com/en-us/124926","date":"2025-08-20"},{"url":"https://support.apple.com/en-us/124927","date":"2025-08-20"},{"url":"https://support.apple.com/en-us/124928","date":"2025-08-20"},{"url":"https://support.apple.com/en-us/124929","date":"2025-08-20"},{"url":"https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-5","date":"2025-08-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-21"},{"url":"https://www.msuiche.com/posts/detecting-cve-2025-43300-a-deep-dive-into-apples-dng-processing-vulnerability/","date":"2025-08-23"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://support.apple.com/en-us/124925","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/124926","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/124927","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/124928","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/124929","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/125141","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/125142","tags":["Release Notes","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Sep/10","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Sep/14","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Sep/52","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/cisagov/vulnrichment/issues/201","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: victim opens crafted image file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Processing a malicious image file may result in memory corruption","start":270,"end":335}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: image parsing enables code execution in client","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Processing a malicious image file may result in memory corruption","start":270,"end":335}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-25409","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25409","exploited":true,"exploitedSince":"2025-08-21","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":1,"earliest":"2025-08-24","earliestUrl":"https://github.com/hunters-sec/CVE-2025-43300","repos":[{"name":"hunters-sec/CVE-2025-43300","url":"https://github.com/hunters-sec/CVE-2025-43300","stars":119,"created":"2025-08-24"},{"name":"PwnToday/CVE-2025-43300","url":"https://github.com/PwnToday/CVE-2025-43300","stars":7,"created":"2025-09-09"},{"name":"ticofookfook/CVE-2025-43300","url":"https://github.com/ticofookfook/CVE-2025-43300","stars":4,"created":"2025-09-30"},{"name":"Dark-life944/CVE-2025","url":"https://github.com/Dark-life944/CVE-2025","stars":1,"created":"2025-09-30"}]},"first":{"date":"2025-08-24","source":"PoC-in-GitHub","url":"https://github.com/hunters-sec/CVE-2025-43300"},"provenance":"source"},"exploitRefs":["https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md"],"flow":[{"stage":"related","techniques":["T1203","T1204.002"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2025-08-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2025-08-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43300","provenance":"source"},{"date":"2025-08-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-08-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25409","provenance":"source"},{"date":"2025-08-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hunters-sec/CVE-2025-43300","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 436 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9925"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}