{"id":2421,"date":"2025-08-22T09:51:58","date_gmt":"2025-08-22T09:51:58","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/08\/22\/apple-releases-patch-for-likely-exploited-zero-day-vulnerability\/"},"modified":"2025-08-22T09:51:58","modified_gmt":"2025-08-22T09:51:58","slug":"apple-releases-patch-for-likely-exploited-zero-day-vulnerability","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/08\/22\/apple-releases-patch-for-likely-exploited-zero-day-vulnerability\/","title":{"rendered":"Apple Releases Patch for Likely Exploited Zero-Day Vulnerability"},"content":{"rendered":"<div id=\"cphContent_pnlArticleBody\" data-layout-id=\"2\" data-edit-folder-name=\"text\" data-index=\"0\">\n<p>In a series of updates for its iOS, iPadOS, and macOS operating systems, Apple released a patch for a previously unknown vulnerability that has likely been exploited in highly targeted attacks.<\/p>\n<p>The vulnerability, tracked as CVE-2025-43300, is an out-of-bounds write vulnerability in the Image I\/O framework, Apple\u2019s built-in framework which allows \u00a0developers to read, write and manipulate image data efficiently.<\/p>\n<p>It affects macOS Ventura before version 13.7, macOS Sonoma before version 14.7, macOS Sequoia before version 15.6, iOS before 18.6 and iPadOS before 17.7 and 18.6.<\/p>\n<p>When the vulnerability is exploited, processing a malicious image file may result in memory corruption.<\/p>\n<p>Apple did not provide a severity score for this vulnerability.<\/p>\n<p>However, the company stated in an August 20 security advisory that it was &#8220;aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.&#8221;<\/p>\n<p>The updates to patched versions, rolled out on August 20, included the following systems:<\/p>\n<ul>\n<li>macOS Ventura 13.7.8<\/li>\n<li>macOS Sonoma 14.7.8<\/li>\n<li>macOS Sequoia 15.6.1<\/li>\n<li>iOS 18.6.2<\/li>\n<li>iPadOS 17.7.10<\/li>\n<li>iPadOS 18.6.2<\/li>\n<\/ul>\n<h2><strong>Open Door for \u2018Zero-Click\u2019 Spyware Attacks<\/strong><\/h2>\n<p>Experts reacting to these updates urged Apple users to quickly install the patched versions, even though known exploitation seemed to be targeted and highly targeted.<\/p>\n<p>Sylvain Cortes, VP of strategy at Hackuity, noted that the vulnerability potentially \u201copens the door to so-called \u2018zero-click\u2019 attacks, where a simple malicious message could let attackers run code without any action from the victim.\u201d<\/p>\n<p>\u201cPrevious exploits of this nature have been used to target government officials, journalists and other high-value individuals,\u201d he added.<\/p>\n<p>Adam Boynton, a senior security strategy manager at Jamf, expressed similar concerns.<\/p>\n<p>\u201cWhile Apple has not confirmed whether this specific flaw was linked to spyware, similar vulnerabilities in Image I\/O and WebKit have previously been used in Pegasus campaigns,\u201d he stated.<\/p>\n<p>\u201cEven though the exploitation appears targeted, we recommend that all users update to iOS 18.6.2 immediately, particularly those in industries most at risk of spyware attacks.\u201d<\/p>\n<p><em>Photo credits:\u00a0nikkimeel \/ Shutterstock.com<\/em><\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>In a series of updates for its iOS, iPadOS, and macOS operating systems, Apple released a patch for a previously unknown vulnerability that has likely been exploited in highly targeted attacks. The vulnerability, tracked as CVE-2025-43300, is an out-of-bounds write vulnerability in the Image I\/O framework, Apple\u2019s built-in framework which allows \u00a0developers to read, write<\/p>\n","protected":false},"author":2,"featured_media":2422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"thumbnail":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c-150x150.jpg",150,150,true],"medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"medium_large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"1536x1536":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"2048x2048":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"morenews-featured":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"morenews-large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"morenews-medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c.jpg",300,300,false],"crawlomatic_preview_image":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/08\/2421-6a3994ec-f254-4f5f-9bdc-3a88877d479c-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"http:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"<a href=\"http:\/\/ft365.org\/index.php\/category\/uncategorized\/\" rel=\"category tag\">Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/2421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=2421"}],"version-history":[{"count":0,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/2421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/2422"}],"wp:attachment":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=2421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=2421"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=2421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}