CVE-2025-43300KEV · OVERDUE

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Critical · published August 21, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.

408
days past CISA
deadline
CVSS v3.1
10.0
EPSS
32%
Percentile
98.3
In the wild
Confirmed
What it is

🚨 A single malicious image file could lead to total chaos! This out-of-bounds write vulnerability can corrupt memory, and it’s already reportedly been exploited in sophisticated attacks against specific targets. 🔥 Think of it like a movie theater showing a film that was edited to contain secret messages. When someone processes that film (the image file), it can distort everything on screen, potentially causing mayhem in the entire system. An attacker could exploit this vulnerability to gain unauthorized access, potentially manipulating system processes or even executing harmful code. This could result in severe data breaches or the complete takeover of devices, putting sensitive personal information at risk.

Put simply

Think of it like a movie theater showing a film that was edited to contain secret messages. When someone processes that film (the image file), it can distort everything on screen, potentially causing mayhem in the entire system. This out-of-bounds write issue occurs when a malicious image is processed, allowing an attacker to write data beyond the intended memory allocation. This can lead to memory corruption, allowing further exploits.

What to do

An attacker could exploit this vulnerability to gain unauthorized access, potentially manipulating system processes or even executing harmful code. This could result in severe data breaches or the complete takeover of devices, putting sensitive personal information at risk. Update your devices immediately to versions iOS 15.8.5, 16.7.12, 18.6.2, or the respective macOS versions mentioned above. Regularly check for updates and ensure that automatic updates are enabled to protect against such vulnerabilities. You can tackle this! With these updates, you’ll be safeguarding your devices like a pro! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.32030 · 98.3th percentile
Published
2025-08-21T00:27Z
KEV added
2025-08-21 · due 2025-09-11
EPSS history
Timeline
  • 29 SEP 03:22Z
    EPSS moved 22% → 32%
    epss
  • 21 AUG 00:27Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5
  • 21 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 11
    kev