Apple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware Attack

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be able to access sensitive user data.

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.

CVE-2025-43300 is an out-of-bounds write (CWE-787) in the Image I/O (ImageIO) framework used by Apple iOS, iPadOS, and macOS. It can be triggered when a device processes a specially crafted image file, corrupting memory in the image-parsing process. Successful exploitation may cause application crashes or allow arbitrary code execution with the privileges of the application handling the image. Because ImageIO is a core system component on essentially every Apple device, virtually all users of iPhones, iPads, and Macs are exposed. The flaw is being exploited in the wild — CISA added it to the KEV catalog on 2025-08-21, mandating patching per BOD 22-01 for federal agencies — and EPSS estimates a 22% probability of exploitation in the next 30 days (98th percentile); no public PoC is known and ransomware use is unconfirmed.

Do: Apply Apple's security updates for iOS, iPadOS, and macOS issued in August 2025 (e.g., iOS 18.6.1 / iPadOS 18.6.1 and macOS Sequoia 15.6.1) on all devices, prioritizing user-facing fleets and agencies bound by BOD 22-01 deadlines. Until devices are patched, exercise caution with images from untrusted sources (email, messaging, web content), since no compensating mitigations are specified. Note that the source data does not enumerate exact affected builds, so verify coverage against Apple's advisory and CISA KEV required actions.

CVE-2025-48384 is a high-severity (CVSS 8.0) link-following/path-interpretation flaw (CWE-59, CWE-436) in Git's config handling: trailing carriage returns are written unquoted into config files and stripped when the value is later read, so a submodule path containing a trailing CR resolves to a different location during submodule initialization. If an attacker crafts a repository whose submodule path ends in a CR and a symlink maps the altered path to the submodule's hooks directory, an executable post-checkout hook inside the submodule is unintentionally run after checkout, yielding arbitrary code execution on the machine running Git (network vector, user interaction required, scope changed, high C/I/A impact). Any user or CI/CD system running an affected Git release when cloning an untrusted repository with maliciously crafted submodule configuration is exposed; CISA lists Git as the affected product, with CPEs also covering Git as packaged by Debian and bundled with Apple's Xcode. The flaw is being exploited in the wild: CISA added it to the KEV catalog on 2025-08-25, news outlets report active exploitation leading to RCE, EPSS is 4.1% (90th percentile), ransomware association is unknown, and no public proof-of-concept is known.

Do: Upgrade Git immediately to 2.50.1 or to the fixed release matching your maintenance line (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, or 2.49.1); on Debian apply the distribution security update and on macOS update Xcode/Command Line Tools via Apple's security update. As an interim check, inspect .gitmodules and repo configuration for submodule paths containing trailing carriage-return characters before initializing submodules from untrusted repositories. Federal agencies must patch per the KEV listing (added 2025-08-25) and BOD 22-01 guidance.

CVE-2025-55177 is an incorrect authorization flaw (CWE-863) in how WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac validate linked device synchronization messages, allowing an unrelated user to trigger processing of content from an arbitrary URL on a target's device. An attacker can reach a vulnerable client through the messaging channel without normal authorization checks, causing the app to fetch or process attacker-chosen content. On its own the flaw carries only partial confidentiality and integrity impact (CVSS 5.4), but Meta assesses it was chained with an Apple OS vulnerability (CVE-2025-43300) in a sophisticated attack against specific, targeted users. Users running WhatsApp for iOS before 2.25.21.73, WhatsApp Business for iOS before 2.25.21.78, or WhatsApp for Mac before 2.25.21.78 are affected. The flaw was added to CISA's KEV catalog on 2025-09-02 amid reports of highly targeted zero-day attacks, though no public proof-of-concept is known and use in ransomware campaigns has not been reported.

Do: Update WhatsApp for iOS to v2.25.21.73 or later, WhatsApp Business for iOS to v2.25.21.78 or later, and WhatsApp for Mac to v2.25.21.78 or later. Also apply Apple's backported OS fix for CVE-2025-43300, since the two flaws were combined in the observed attack chain. Review and re-link WhatsApp companion devices if compromise is suspected; federal agencies must follow BOD 22-01 required-action deadlines per the KEV listing.