Apple on Monday backported fixes for a just lately patched safety flaw that has been actively exploited within the wild.
The vulnerability in query is CVE-2025-43300 (CVSS rating: 8.8), an out-of-bounds write challenge within the ImageIO element that would end in reminiscence corruption when processing a malicious picture file.
“Apple is conscious of a report that this challenge could have been exploited in an especially subtle assault in opposition to particular focused people,” the corporate mentioned.
Since then, WhatsApp has acknowledged {that a} vulnerability in its messaging apps for Apple iOS and macOS (CVE-2025-55177, CVSS rating: 5.4) had been chained with CVE-2025-43300 as a part of highly-targeted spy ware assaults geared toward lower than 200 people.
Whereas the shortcoming was first addressed by the iPhone maker late final month with the discharge of iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Ventura 13.7.8, macOS Sonoma 14.7.8, and macOS Sequoia 15.6.1, it has additionally been launched for the next older variations –
- iOS 16.7.12 and iPadOS 16.7.12 – iPhone 8, iPhone 8 Plus, iPhone X, iPad fifth technology, iPad Professional 9.7-inch, and iPad Professional 12.9-inch 1st technology
- iOS 15.8.5 and iPadOS 15.8.5 – iPhone 6s (all fashions), iPhone 7 (all fashions), iPhone SE (1st technology), iPad Air 2, iPad mini (4th technology), and iPod contact (seventh technology)
The updates have been rolled out alongside iOS 26, iPadOS 26, iOS 18.7, iPadOS 18.7, macOS Tahoe 26, macOS Sequoia 15.7, macOS Sonoma 14.8, tvOS 26, visionOS 26, watchOS 26, Safari 26, and Xcode 26, which additionally deal with various different safety flaws –
- CVE-2025-31255 – An authorization vulnerability in IOKit that would enable an app to entry delicate knowledge
- CVE-2025-43362 – A vulnerability in LaunchServices that would enable an app to observe keystrokes with out consumer permission
- CVE-2025-43329 – A permissions vulnerability in Sandbox that would enable an app to interrupt out of its sandbox
- CVE-2025-31254 – A vulnerability in Safari that would end in sudden URL redirection when processing maliciously crafted net content material
- CVE-2025-43272 – A vulnerability in WebKit that would end in sudden Safari crash when processing maliciously crafted net content material
- CVE-2025-43285 – A permissions vulnerability in AppSandbox that would enable an app to entry protected consumer knowledge
- CVE-2025-43349 – An out-of-bounds write challenge in CoreAudio that would end in sudden app termination when processing a maliciously crafted video file
- CVE-2025-43316 – A permissions vulnerability in DiskArbitration that would enable an app to achieve root privileges
- CVE-2025-43297 – A sort confusion vulnerability in Energy Administration that would end in a denial-of-service
- CVE-2025-43204 – A vulnerability in RemoteViewServices that would enable an app to interrupt out of its sandbox
- CVE-2025-43358 – A permissions vulnerability in Shortcuts that would enable a shortcut to bypass sandbox restrictions
- CVE-2025-43333 – A permissions vulnerability in Highlight that would enable an app to achieve root privileges
- CVE-2025-43304 – A race situation vulnerability in StorageKit that would enable an app to achieve root privileges
- CVE-2025-48384 – A Git vulnerability in Xcode that would end in distant code execution when cloning a maliciously crafted repository
Whereas there isn’t any proof that any of the aforementioned flaws have been weaponized in real-world assaults, it is all the time a great apply to maintain techniques up-to-date for optimum safety.
