CVE-2025-43300

Опубликовано: 21 авг. 2025

Источник: nvd

CVSS3: 10

EPSS Средний

Описание

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Ссылки

https://support.apple.com/en-us/124925
Release Notes
Vendor Advisory
https://support.apple.com/en-us/124926
Release Notes
Vendor Advisory
https://support.apple.com/en-us/124927
Release Notes
Vendor Advisory
https://support.apple.com/en-us/124928
Release Notes
Vendor Advisory
https://support.apple.com/en-us/124929
Release Notes
Vendor Advisory
https://support.apple.com/en-us/125141
Release Notes
Vendor Advisory
https://support.apple.com/en-us/125142
Release Notes
Vendor Advisory
http://seclists.org/fulldisclosure/2025/Sep/10
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Sep/14
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Sep/52
Mailing List
Third Party Advisory
https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-43300.md
Exploit
Third Party Advisory
https://github.com/cisagov/vulnrichment/issues/201
Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43300
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 15.8.5 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 16.0 (включая) до 16.7.12 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.7.10 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 18.0 (включая) до 18.6.2 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 15.8.5 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 16.0 (включая) до 16.7.12 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 18.6.2 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.7.8 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.7.8 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 15.0 (включая) до 15.6.1 (исключая)

EPSS

Процентиль: 97%

0.21994

Средний

10 Critical

CVSS3

Дефекты

CWE-787

Связанные уязвимости

GHSA-cpwx-wfp4-x368

CVSS3: 8.8

github

около 1 года назад

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.7.8, macOS Ventura 13.7.8, iPadOS 17.7.10, macOS Sequoia 15.6.1, iOS 18.6.2 and iPadOS 18.6.2. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

BDU:2025-10189

CVSS3: 8.8

fstec

около 1 года назад

Уязвимость фреймворка для обработки изображений ImageIO операционных систем iOS, iPadOS, macOS, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 97%

0.21994

Средний

10 Critical

CVSS3

Дефекты

CWE-787