"Zero-Click Spyware Lurks in Apple Images—Update Now or Risk Everything"

Apple has released critical security updates for multiple platforms, addressing a zero-day vulnerability that has been actively exploited in sophisticated cyberattacks. The flaw, identified as CVE-2025-43300, resides in the ImageIO component of iOS, iPadOS, and macOS systems and allows attackers to execute malicious code through specially crafted image files. The vulnerability was confirmed to have been used in targeted attacks against specific individuals, prompting Apple to issue emergency patches for iOS 18.6.2, iPadOS 18.6.2, macOS Sonoma 14.7.8, macOS Ventura 13.7.8, iPadOS 17.7.10, and macOS Sequoia 15.6.1 [3].

The vulnerability stems from an out-of-bounds write issue, which occurs when the system processes a malicious image file. This flaw allows attackers to overwrite critical memory areas, potentially leading to memory corruption and unauthorized code execution. According to Apple’s security advisory, the issue was patched through improved bounds checking, a method to ensure that data operations remain within allocated memory limits. The company emphasized that it is aware of reports that this issue may have been exploited in a highly sophisticated cyberattack, although it did not disclose further details regarding the attackers or the specific targets [3].

Security experts have highlighted the potential risks associated with the vulnerability, particularly for users who store sensitive information such as cryptocurrency assets on their devices. A successful exploitation could allow attackers to access private keys, seed phrases, and login credentials stored on the device, thereby compromising the user’s digital assets. Additionally, the flaw could be leveraged in spyware campaigns, where malicious images are delivered via email, messaging apps, or websites to silently install monitoring software without user interaction. The vulnerability’s potential for zero-click attacks—where no user action is required—has further raised concerns among cybersecurity professionals [4].

The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, with a due date of September 11, 2025, for applying mitigations or discontinuing the affected products. CISA has issued a binding operational directive (BOD 22-01) for federal agencies to ensure that known exploited vulnerabilities are addressed promptly. The directive mandates that users either follow vendor guidance for mitigation or cease using affected systems if no mitigations are available [1].

Apple users are strongly advised to update their devices immediately to protect against potential exploitation. The patches are available for a wide range of Apple products, including the iPhone XS and later models, various iPad Pro and iPad Air models, and multiple Mac operating systems. Security professionals recommend that users manually check for the updates via Settings > General > Software Update to ensure timely installation. Given the confirmed active exploitation, delays in updating could leave devices vulnerable to compromise, especially in high-risk sectors such as media, legal, and public affairs [5].

As the cybersecurity landscape continues to evolve, the incident underscores the importance of timely software updates in mitigating sophisticated cyber threats. Apple’s coordinated disclosure approach, which avoids publicizing vulnerabilities until patches are available, aligns with best practices in the industry. However, the fact that the flaw was actively exploited indicates that attackers were already leveraging it in targeted campaigns before the patch was released. This highlights the need for organizations and individuals to remain vigilant and prioritize patch management as a core component of their cybersecurity strategy [3].

Source:

[1] CVE-2025-43300 (https://www.tenable.com/cve/CVE-2025-43300)

[2] About the security content of iOS 18.6.2 and iPadOS 18.6.2 (https://support.apple.com/en-us/124925)

[3] Apple Confirms Critical 0-Day Under Active Attack (https://gbhackers.com/apple-confirms-critical-0-day-under-active-attack/)

[4] Apple Fixes Critical Vulnerability That Put Your Crypto in Danger (https://u.today/apple-fixes-critical-vulnerability-that-put-your-crypto-in-danger)

[5] iOS 18.6.2—Update Now Warning Issued To All iPhone Users (https://www.forbes.com/sites/kateoflahertyuk/2025/08/22/ios-1862-update-now-warning-issued-to-all-iphone-users/)