Apple Releases iOS 18.6.2: Zero-Click Spyware Patch for Active…

On August 20, 2025, Apple patched CVE-2025-43300, an out-of-bounds write in the ImageIO framework exploited in spyware attacks against targeted individuals. The fix covers iPhone XS and later models; older devices receive no protection.

Apple released iOS 18.6.2 and iPadOS 18.6.2 on August 20, 2025 to address a single vulnerability in the ImageIO framework, tracked as CVE-2025-43300. The flaw, an out-of-bounds write caused by insufficient bounds checks, was exploited in "extremely sophisticated" attacks against "specific targeted individuals." The advisory's language and structure follow the historical pattern of commercial spyware campaigns, where selective targeting masks a much broader attack surface: iOS's media parser.

Key Takeaways

On August 20, 2025, Apple shipped iOS 18.6.2 and iPadOS 18.6.2 with a single security patch, CVE-2025-43300, for an out-of-bounds write in the ImageIO framework.
The vulnerability allowed arbitrary code execution via a malicious image, with potential background activation during preview or receipt through apps.
Apple confirms active exploitation against "specific targeted individuals," terminology associated with high-grade spyware campaigns.
The patch covers only iPhone XS and later, iPad Pro 3rd generation and later, iPad Air 3 and later, iPad mini 5 and later, and iPad 7th generation and later; older devices do not receive the fix.

The Mechanism: Why ImageIO Remains a Prime Target

Apple's ImageIO framework handles parsing and decoding of image formats across the iOS, iPadOS, and macOS ecosystems. CVE-2025-43300 resides in an out-of-bounds write: insufficient bounds checks allow a malicious image to write past the allocated buffer, corrupting memory. Apple fixed the flaw by "adding tighter bounds checks," according to the technical description from the source.

The framework's nature — processing images in the background for previews, notifications, sharing, and in-app rendering — makes a zero-click exploit plausible, where the device is compromised without conscious user interaction. The source explicitly cites the scenario: "Your phone could be hit in the background while previewing an image or receiving it through an app." This vector eliminates the traditional weak link of social engineering, typical of phishing or malicious links.

The source does not specify which app or delivery protocol conveyed the malicious image in the documented cases. The vector could be a messaging service, email, or any platform that generates automatic previews. This gap in the reconstruction prevents defining selective countermeasures for end users.

Apple's Policy: Disclosure Only After Patching

Apple confirms via its support portal that "For the protection of our customers, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are generally available." This policy, documented in the provided texts, explains why the vulnerability details emerged only on August 20, 2025, simultaneously with the release of iOS 18.6.2.

The coordinated disclosure model, while protecting users from premature publication of verifiable exploits, creates a vulnerability window managed internally. Those with hardware no longer covered by security updates receive no advance notice nor, in this case, any patch. The source explicitly observes that "Older hardware didn't get the fix, which means anyone still holding onto older devices is stuck without protection."

The Threat Profile: From "Targeted Individuals" to Attack Surface

Apple describes the attacks as "extremely sophisticated" and directed at "specific targeted individuals." The source adds an interpretive element: "That phrasing usually signals spyware campaigns against high-profile users like journalists, lawyers, and activists." This interpretation, while not an official Apple confirmation, fits a documented pattern in the commercial surveillance sector, where vendors like NSO Group (cited only as a historical analogy, not as an attribution for this campaign) have historically exploited similar vulnerabilities in iMessage and other media parsers.

No infrastructure overlaps linking this campaign's actor to known threat groups emerge in the sources. The operators' identity, victim count, attack geography, and spyware vendor, if any, remain unspecified. What is documented is the active exploitation capability of a zero-click vulnerability in a widely distributed system component.

Why It Matters

The release of iOS 18.6.2 as a single-focus update — one security patch — signals a severity Apple reserves for flaws with confirmed in-the-wild exploitation. The decision to omit other fixes minimizes regression surface, accelerating adoption, but also implies the risk was judged to outweigh the benefits of a delayed cumulative release.

The brief does not document specific remedial measures for devices excluded from the patch. Apple lists no alternative mitigations, configuration workarounds, or security-only support extensions for models prior to iPhone XS. The source does not specify the exact nature of data at risk on compromised devices, nor whether the exploit gains elevated privileges or persistence beyond initial execution.

For enterprise device fleets, the case confirms that the media parsing framework remains a priority attack surface for spyware operations. Hardware lifecycle management — when a model exits security patch support — becomes a quantifiable risk variable, not just functional obsolescence.

"Apple says the bug was used in 'extremely sophisticated' attacks against 'specific targeted individuals.'"

The dossier does not specify whether CVE-2025-43300 has an assigned CVSS score in the official sources available. The CVSS 10 CRITICAL value cited in the VERIFIED OFFICIAL FACTS comes from a source not detailed in the brief; the primary sources consulted do not report the score textually. This gap does not alter the operational assessment — active exploitation, zero-click, arbitrary code — but signals a limit in public documentation.

FAQ

Should I update even if I'm not a journalist or activist?
The source documents attacks against "specific targeted individuals," but the zero-click mechanism in a system parser exposes any device that receives images. The update is recommended for all covered models.

Why don't iPhone X or 8 Plus get the patch?
Apple limits security support to a defined hardware generation. The source explicitly states that "Older hardware didn't get the fix" without providing detailed technical rationale.

Is there a way to protect uncovered devices?
The brief documents no workarounds, configuration mitigations, or mitigation tools for models prior to iPhone XS.

Information is based on the cited source and current as of publication.

Sources

Sources and references