CVE-2025-43300

Published Aug 21, 2025

Last updated 4 months ago

Exploit known CVSS critical 10.0

Mobile device

Apple

iOS

Overview

Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Source: product-security@apple.com
NVD status: Analyzed
Products: ipados, iphone_os, macos

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Exploit added on: Aug 21, 2025
Exploit action due: Sep 11, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CBDB9319-770B-401B-8D7E-40BB6E370446",
            "versionEndExcluding": "15.8.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9BD176E0-E5C8-4009-A214-B8C9AFA59934",
            "versionEndExcluding": "16.7.12",
            "versionStartIncluding": "16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E640930D-FE94-4B16-9512-9E95091644E5",
            "versionEndExcluding": "18.6.2",
            "versionStartIncluding": "18.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E1F99051-EE84-4D7D-8042-688337134F24",
            "versionEndExcluding": "15.8.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D79D2C71-2062-4D9E-8E3C-23C00CEE6226",
            "versionEndExcluding": "16.7.12",
            "versionStartIncluding": "16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "31536890-ADCB-49F4-AEAA-A10FC40D4881",
            "versionEndExcluding": "18.6.2",
            "versionStartIncluding": "18.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1B590C13-CEA2-44D3-8C0A-B15A61F424AB",
            "versionEndExcluding": "13.7.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References