CVE-2025-43300

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

• CWE-787

• https://support.apple.com/en-us/124925Release Notes, Vendor Advisory
• https://support.apple.com/en-us/124926Release Notes, Vendor Advisory
• https://support.apple.com/en-us/124927Release Notes, Vendor Advisory
• https://support.apple.com/en-us/124928Release Notes, Vendor Advisory
• https://support.apple.com/en-us/124929Release Notes, Vendor Advisory
• https://support.apple.com/en-us/125141Release Notes, Vendor Advisory
• https://support.apple.com/en-us/125142Release Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2025/Sep/10Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2025/Sep/14Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2025/Sep/52Mailing List, Third Party Advisory
• https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.mdExploit, Third Party Advisory
• https://github.com/cisagov/vulnrichment/issues/201Issue Tracking
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300US Government Resource

Published

Aug 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43295A denial-of-service issue was addressed with improved valida…5.5
• CVE-2025-43296A logic issue was addressed with improved validation. This i…5.5
• CVE-2025-43297A type confusion issue was addressed with improved memory ha…6.2
• CVE-2025-43298A parsing issue in the handling of directory paths was addre…7.8
• CVE-2025-43299A denial-of-service issue was addressed with improved valida…5.5
• CVE-2025-4330Allows the extraction filter to be ignored, allowing symlink…7.5
• CVE-2025-43301A privacy issue was addressed with improved private data red…3.3
• CVE-2025-43302An out-of-bounds write issue was addressed with improved bou…5.5
• CVE-2025-43303A logging issue was addressed with improved data redaction. …5.5
• CVE-2025-43304A race condition was addressed with improved state handling.…7
• CVE-2025-43305A logic issue was addressed with improved checks. This issue…5.5
• CVE-2025-43306A logic issue was addressed with improved checks. This issue…7.8