All vulnerabilities
CVE-2025-43300

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and macOSOperating systems
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 21 Aug 2025CISA KEV
Exploit odds (EPSS)32.0%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.8.5Also 16.7.12, 18.6.2 and 4 moreCVE List
Federal deadline11 Sep 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

Show all 7 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 21 Aug 2025, 00:27 UTCPublishedCVE List
  2. 21 Aug 2025Added to CISA KEVCISA KEV

Description

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.

Text from CVE List

Affected versions 7

  • iOS and iPadOSaffected: all versions before 15.8.5CVE List
  • iOS and iPadOSaffected: all versions before 16.7.12CVE List
  • iOS and iPadOSaffected: all versions before 18.6.2CVE List
  • iPadOSaffected: all versions before 17.7.10CVE List
  • macOSaffected: all versions before 13.7.8CVE List
  • macOSaffected: all versions before 14.7.8CVE List
  • macOSaffected: all versions before 15.6.1CVE List

References 11