Apple Backports CVE-2025-43300 Zero-Day Fix After Targeted Spyware Attacks

8 sources · Updated 4mo ago · First seen Sep 16, 2025

Apple has backported a fix for CVE-2025-43300, an ImageIO out-of-bounds write vulnerability exploited in sophisticated attacks targeting specific individuals. The flaw was chained with a WhatsApp vulnerability (CVE-2025-55177) in highly-targeted spyware campaigns affecting fewer than 200 users. Updates are now available for both current and older iOS, iPadOS, and macOS devices.

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Sep 16, 2025 – May 26, 2026

May 26, 20265mo ago
Forenser reports zero-click iOS 16 campaign hijacking WhatsApp accounts
Italian digital forensics firm Forenser reported a zero-click campaign targeting iPhones running iOS 16 that hijacked WhatsApp accounts without user interaction. The attackers allegedly exploited CVE-2025-43300 in ImageIO, and possibly CVE-2025-55177, to extract cryptographic material, instantiate rogue WhatsApp sessions, and send fraudulent money-transfer requests from victims' accounts.
Zero-click attack hijacks WhatsApp accounts on iOS 16 | brief | SC Media
Feb 12, 20269mo ago
Apple patches decade-old iOS zero-day exploited in the wild
Apple released security updates to fix a decade-old iOS zero-day vulnerability that had been exploited in the wild. The patch disclosure marks the first substantive event captured for this story.
Apple patches decade-old iOS zero-day exploited in the wild
Jan 11, 202610mo ago
GitHub repository publishes Glass Cage iOS exploit chain details
A GitHub repository publicly described the 'Glass Cage' zero-click PNG-based iOS 18.2.1 exploit chain, linking ImageIO, WebKit, and Core Media flaws to achieve sandbox escape, kernel-level access, and device compromise via iMessage. The publication exposed technical details of the attack chain before Apple's later patch release.
GitHub - JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201: Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), then WebKit(CVE-2025-24201) and Core Media(CVE-2025-24085) to achieve sandbox escape, kernel-level access, and device bricking. Triggered via iMessage, it enables full compromise with no user interaction. · GitHub
Sep 16, 20251y ago
Story first reported
Initial story creation

Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.

Check your exposure

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · May 27, 2026

New 0-Click WhatsApp Account Takeover Attack Targeting iOS 16 UsersOpen source ↗

ScworldNews · May 26, 2026

Zero-click attack hijacks WhatsApp accounts on iOS 16 | brief | SC MediaOpen source ↗

Apple patches decade-old iOS zero-day exploited in the wildOpen source ↗

Github WebNews · Jan 11, 2026

GitHub - JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201: Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), then WebKit(CVE-2025-24201) and Core Media(CVE-2025-24085) to achieve sandbox escape, kernel-level access, and device bricking. Triggered via iMessage, it enables full compromise with no user interaction. · GitHubOpen source ↗

CyberthroneNews · Sep 17, 2025

CVE-2025-43300: Apple’s Critical Zero-Day ImageIO VulnerabilityOpen source ↗

The Hacker NewsNews · Sep 16, 2025

Apple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware AttackOpen source ↗

CyberthroneNews · Sep 16, 2025

Apple Releases iOS 26: Key Updates and Vulnerability PatchesOpen source ↗

Bleeping ComputerNews · Sep 16, 2025

Apple backports zero-day patches to older iPhones and iPadsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Apple Backports CVE-2025-43300 Zero-Day Fix After Targeted Spyware Attacks

How this story unfolded

Forenser reports zero-click iOS 16 campaign hijacking WhatsApp accounts

Apple patches decade-old iOS zero-day exploited in the wild

GitHub repository publishes Glass Cage iOS exploit chain details

Story first reported

Sources

See the full picture, correlated to your attack surface.

Related stories

Apple and Meta Patch Zero-Day Exploited in Sophisticated Surveillanceware Attacks

Apple Patched iPhone and iPad Flaws Linked to Targeted Spyware Attacks

Apple Patches Potentially Exploited CoreGraphics Zero-Day on Older iPhones and iPads

Apple Backports CVE-2025-43300 Zero-Day Fix After Targeted Spyware Attacks

How this story unfolded

Forenser reports zero-click iOS 16 campaign hijacking WhatsApp accounts

Apple patches decade-old iOS zero-day exploited in the wild

GitHub repository publishes Glass Cage iOS exploit chain details

Story first reported

Sources

See the full picture, correlated to your attack surface.

Related stories

Apple and Meta Patch Zero-Day Exploited in Sophisticated Surveillanceware Attacks

Apple Patched iPhone and iPad Flaws Linked to Targeted Spyware Attacks

Apple Patches Potentially Exploited CoreGraphics Zero-Day on Older iPhones and iPads