InfoSecBulletin Cybersecurity for mankind
Apple has issued urgent security updates to fix a zero-day vulnerability that is being actively exploited, warning that attackers may have used it in targeted campaigns.
CVE-2025-43300 is a flaw in Apple’s Image I/O framework that allows out-of-bounds writing, affecting how applications manage common image file formats.
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
According to Apple’s advisory:
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
The vulnerability lets attackers create harmful image files that, when used by a vulnerable application, could cause memory corruption. This could allow them to execute arbitrary code, leading to surveillance or device compromise.
Apple explained the fix as follows:
“An out-of-bounds write issue was addressed with improved bounds checking. Processing a malicious image file may result in memory corruption.”
The company has released patches across its ecosystem, urging all users to apply them immediately:
iOS 18.6.2 and iPadOS 18.6.2
iPadOS 17.7.10
macOS Sequoia 15.6.1
macOS Sonoma 14.7.8
macOS Ventura 13.7.8
This wide coverage underscores how deeply integrated the Image I/O framework is across Apple products.
As is common with zero-day disclosures, Apple has not shared technical details about the exploitation, the identity of the attackers, or the profile of the victims. The zero-day is being leveraged in precision-targeted campaigns, potentially linked to spyware operations or nation-state threat actors.
With CVE-2025-43300 marked as actively exploited, users are strongly advised to:
Update immediately to the latest iOS, iPadOS, and macOS versions.
Be cautious when receiving unexpected images or opening files from untrusted sources.
Copilot Breaks Your Audit Log, but Microsoft Won’t Tell the customer
