WhatsApp Patches Zero-Day, Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-43300 | Actively Exploited Out-of-Bounds Write in Apple iOS/iPadOS/macOS Image I/O CVE-2025-43300 is an out-of-bounds write (CWE-787) in the Image I/O (ImageIO) framework used by Apple iOS, iPadOS, and macOS. It can be triggered when a device processes a specially crafted image file, corrupting memory in the image-parsing process. Successful exploitation may cause application crashes or allow arbitrary code execution with the privileges of the application handling the image. Because ImageIO is a core system component on essentially every Apple device, virtually all users of iPhones, iPads, and Macs are exposed. The flaw is being exploited in the wild — CISA added it to the KEV catalog on 2025-08-21, mandating patching per BOD 22-01 for federal agencies — and EPSS estimates a 22% probability of exploitation in the next 30 days (98th percentile); no public PoC is known and ransomware use is unconfirmed. Do: Apply Apple's security updates for iOS, iPadOS, and macOS issued in August 2025 (e.g., iOS 18.6.1 / iPadOS 18.6.1 and macOS Sequoia 15.6.1) on all devices, prioritizing user-facing fleets and agencies bound by BOD 22-01 deadlines. Until devices are patched, exercise caution with images from untrusted sources (email, messaging, web content), since no compensating mitigations are specified. Note that the source data does not enumerate exact affected builds, so verify coverage against Apple's advisory and CISA KEV required actions. | 10.0 | 22% | KEV PoC |
| mass>1 billion active Apple devices (ImageIO is a core framework on all iOS/iPadOS/macOS devices; Apple's active device base exceeds 2 billion) | |
| CVE-2025-55177 | Incorrect Authorization in WhatsApp Linked-Device Sync Used in Targeted Spyware Attacks CVE-2025-55177 is an incorrect authorization flaw (CWE-863) in how WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac validate linked device synchronization messages, allowing an unrelated user to trigger processing of content from an arbitrary URL on a target's device. An attacker can reach a vulnerable client through the messaging channel without normal authorization checks, causing the app to fetch or process attacker-chosen content. On its own the flaw carries only partial confidentiality and integrity impact (CVSS 5.4), but Meta assesses it was chained with an Apple OS vulnerability (CVE-2025-43300) in a sophisticated attack against specific, targeted users. Users running WhatsApp for iOS before 2.25.21.73, WhatsApp Business for iOS before 2.25.21.78, or WhatsApp for Mac before 2.25.21.78 are affected. The flaw was added to CISA's KEV catalog on 2025-09-02 amid reports of highly targeted zero-day attacks, though no public proof-of-concept is known and use in ransomware campaigns has not been reported. Do: Update WhatsApp for iOS to v2.25.21.73 or later, WhatsApp Business for iOS to v2.25.21.78 or later, and WhatsApp for Mac to v2.25.21.78 or later. Also apply Apple's backported OS fix for CVE-2025-43300, since the two flaws were combined in the observed attack chain. Review and re-link WhatsApp companion devices if compromise is suspected; federal agencies must follow BOD 22-01 required-action deadlines per the KEV listing. | 5.4 | 4% | KEV |
| masshundreds of millions of users (WhatsApp's multi-billion user base includes a very large iOS/macOS install base) |
Full article366 words · extracted from infosecurity-magazine.com · click to collapse
WhatsApp has patched a critical zero-day vulnerability it believes was exploited in a sophisticated attack.
The messaging giant revealed in a security advisory late last week that CVE-2025-55177 relates to “incomplete authorization of linked device synchronization messages.”
The firm added: “It could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.”
The Apple bug in question was described by the tech giant as an “out-of-bounds write issue” when it patched it on August 20.
“Processing a malicious image file may result in memory corruption,” it said at the time.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
Read more on WhatsApp bugs: Spyware Maker NSO Group Liable for WhatsApp User Hacks
Given the messaging from both firms, it’s highly likely that the bugs were exploited as part of a commercial spyware campaign. In fact, this was confirmed by Donncha Ó Cearbhaill, head of the security lab at Amnesty International, where he hunts for spyware used to target civil society.
In April 2023, for example, security researchers found a zero-click, zero-day exploit that targeted iPhone users with commercial spyware a couple of years previously. In that campaign, malware designed by secretive Israeli firm QuaDream was used.
These exploits are particularly dangerous as they require no user interaction to work, meaning victims are completely unaware that their every move is being watched. Once installed, spyware such as this, or the infamous Pegasus variant from NSO Group, is designed to access the device camera, microphone, messages, photos and much more.
NSO Group was ordered to pay $167m in damages earlier this year after a long-running legal battle with WhatsApp. It stemmed from a 2019 discovery that Pegasus had been used to target over a thousand WhatsApp users, including human rights activists, journalists and diplomats.
CVE-2025-55177 impacts WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78 and WhatsApp for Mac v2.25.21.78.
Image credit: MardeFondos / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/whatsapp-patches-zeroday-zeroclick/