CISA Adds Apple Zero-Day CVE-2025-43300 to KEV Catalog: CVSS 10,…

CISA has cataloged CVE-2025-43300, an out-of-bounds write in Apple ImageIO rated CVSS 10.0 CRITICAL. Federal civilian agencies must patch by September 11, 2025. Apple confirms the flaw has been exploited in extremely sophisticated, targeted attacks.

CISA added CVE-2025-43300 to the Known Exploited Vulnerabilities Catalog on August 21, 2025, setting a September 11, 2025 patching deadline for federal civilian agencies under Binding Operational Directive 22-01. Apple confirmed the vulnerability—an out-of-bounds write in the ImageIO framework—has been exploited in extremely sophisticated attacks against specific targeted individuals. The bug is zero-click: processing a malicious image triggers compromise without any victim interaction.

Key Takeaways

CISA set a September 11, 2025 deadline for mandatory patching across all federal civilian agencies, with a severity rating of 8.8/10 per CISA officials as reported by The Record.
CISA-ADP assigns the same vulnerability a CVSS 3.1 score of 10.0 CRITICAL, with a network attack vector, no user interaction required, and maximum impact on confidentiality, integrity, and availability per the NVD record.
Apple confirms exploitation in "extremely sophisticated" attacks against specific targets: the vector is processing malicious images via messages, email, or web content.
Patches cover iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, iOS/iPadOS 16.7.12, iOS/iPadOS 15.8.5, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8 per the official CVE record.

Why ImageIO Remains a Favorite Target for Spyware Vendors

Apple's ImageIO framework handles image parsing and decoding across the iOS, iPadOS, and macOS ecosystem. Its architectural position makes it particularly attractive: it processes media files received from any channel before the user consciously opens them. A memory corruption bug like the out-of-bounds write documented in CVE-2025-43300 allows overwriting memory regions outside allocated bounds, with potential arbitrary code execution in the ImageIO process context.

The key point is that Apple had introduced countermeasures to reduce the zero-click attack surface, including blocking links from unknown senders in iMessage. This measure shifted actor interest toward formats that don't require a conscious click: images, which ImageIO processes automatically in most communication apps.

Zero-Click, Zero Defense: How the Attack Chain Works

The defining characteristic of CVE-2025-43300 is the absence of user interaction. Mayuresh Dani, security research manager at Qualys, describes the mechanism: "This is a zero-click exploit that requires no user interaction, and can be triggered simply by processing a maliciously crafted image file, which could be delivered through various channels including messages, emails, or web content." The quote is from analysis published by The Record.

This profile renders most standard behavioral recommendations useless. The victim does not need to open suspicious attachments, follow links, or ignore security warnings. The image is processed by the operating system in the background, and the failed bounds-checking bug allows overwriting adjacent memory. From there, advanced exploit techniques achieve code execution.

The NVD record specifies the attack vector as network (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and changed scope (S:C). The combination produces the maximum score of 10.0 on the CISA-ADP scale, even though the internal CISA rating is estimated at 8.8/10. The dossier does not clarify the reason for this discrepancy between the two metrics.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals" — Apple Inc., advisory security content

What to Do Now

Immediately update all Apple devices to the patched versions listed in the CVE record: iOS/iPadOS 18.6.2, iPadOS 17.7.10, iOS/iPadOS 16.7.12, iOS/iPadOS 15.8.5, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8.
Contractors and vendors operating for federal civilian agencies must ensure patching completion by September 11, 2025 to comply with CISA's BOD 22-01 mandate, with documented compliance audits.
Monitor threat intelligence feeds for inclusion of CVE-2025-43300 to detect potential variants or evolutions of the exploit technique, given the bug resides in generic image parsing.

The Gap Between CVSS 10 and Narrow Targeting: Reading the Numbers

Satnam Narang, senior staff research engineer at Tenable, articulates the risk-perception paradox: "While the impact to the wider populace is smaller because the attackers exploiting CVE-2025-43300 had a narrow, targeted focus, Apple wants the public to pay attention to the threat and take immediate action." The quote, reported by The Record, highlights a recurring dynamic in modern cybersecurity.

The CVSS 10.0 CRITICAL score describes technical severity and ease of exploitation, not the likelihood of a generic user being hit. The targeted nature of the attack confirmed by Apple—"specific targeted individuals"—suggests the operators behind this campaign select victims deliberately, likely based on intelligence or activism profiles. This does not reduce patching urgency for government and enterprise infrastructure, which represent strategic targets of interest.

The discrepancy between the CISA rating of 8.8/10 and the CISA-ADP 10.0 likely reflects different assessment perspectives: the former incorporates operational context and targeting estimates, the latter is a purely technical measure of exploitability and impact. Both values place the vulnerability in the high-risk tier.

Apple has not responded to requests for clarification on the actual use of the vulnerability, nor provided details on victim count or attack geography. This reticence is consistent with handling highly sensitive incidents, where excessive disclosure can compromise ongoing investigations or further expose already-targeted victims.

The Regulatory Context: Why BOD 22-01 Accelerates Response

CISA's Binding Operational Directive 22-01 imposes a structured vulnerability management process for known exploited vulnerabilities on Federal Civilian Executive Branch agencies. Inclusion in the KEV Catalog automatically triggers a binding remediation timer: in the case of CVE-2025-43300, less than three weeks from addition to deadline.

This mechanism, introduced in November 2021, transformed the KEV from a simple informational repository into an operational governance tool. Agencies must document patching status and justify any exceptions, with CISA monitoring compliance through automated scans and periodic audits. The September 11, 2025 deadline is therefore a legally binding constraint, not a best-practice recommendation.

For the private sector, BOD 22-01 does not directly apply, but the presence of CVE-2025-43300 in the KEV signals a vulnerability with confirmed exploit in active circulation. Enterprises handling sensitive data or operating in regulated sectors should treat this alert with the same priority as federal agencies.

Information verified against cited sources and current as of publication.

Sources

Sources and references