Apple just released an emergency patch for a zero-day exploited in the wild – here’s why you need to update now
Apple is warning millions of users of iPhones, iPads and Macs to update their software to protect against an out-of-bounds write vulnerability
Apple has issued an emergency security update for iPhone, iPad, and Mac users to patch a critical zero-day vulnerability that it said has already been exploited in the wild.
The out-of-bounds write vulnerability, designated CVE-2025-43300, was discovered by Apple security researchers and affects the Image I/O framework, which enables applications to read and write various different image file formats.
"Processing a malicious image file may result in memory corruption,” the tech giant said in an advisory.
An out-of-bounds write vulnerability occurs when attackers write data outside a program's allocated memory boundaries, potentially overwriting critical system information - in this case by sending a malicious image delivered via email, messaging apps or malicious websites.
If the victim opens the image, it could allow the attackers to carry out arbitrary code execution, potentially allowing them to take full control of an affected device and spy on users, steal data or install further malware.
The flaw affects the iPhone XS and later models, according to Apple. Devices impacted include:
- iPad Pro 13-inch
- iPad Pro 12.9-inch, 3rd generation and later
- iPad Pro 11-inch, 1st generation and later
- iPad Air, 3rd generation and later
- iPad 7th generation and later
- iPad mini, 5th generation and later
Worryingly, the flaw has already been exploited in the wild.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals," the company said - without giving any further details.
Apple urges users to update immediately
While this implies that the general public is unlikely to be targeted, Apple is advising users to install the new update, which includes improvements to bounds checking, immediately, via Settings, General and Software Update.
The chances are high that the successful attackers are nation-state actors. Similar exploits of Apple devices in the past have been linked to the use of spyware such as Israeli firm NSO Group's Pegasus software.
Already this year, Apple has patched five zero-days that have been exploited in the wild. These included:
- CVE-2025-24085
- CVE-2025-24200
- CVE-2025-24201
- CVE-2025-31200
- CVE-2025-31201
There were half a dozen more last year, figures show. The company also last month patched a Safari vulnerability - CVE-2025-6558 - residing in an open source component.
Google reported it had been exploited as a zero-day in the Chrome web browser.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
The UK AI revolution: navigating the future of the intelligent enterpriseAs AI reshapes industries and societies, decision-makers in the UK face a critical choice: build a sovereign future or merely import it.
-
Turning the UK AI revolution into a sovereign realityThe UK AI Revolution documentary series posed difficult questions about AI’s hype, control, and future. Now, IT leaders must find the architectural answers
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Supply chain and AI security in the spotlight for cyber leaders in 2026News Organizations are sharpening their focus on supply chain security and shoring up AI systems
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
NHS supplier DXS International confirms cyber attack – here’s what we know so farNews The NHS supplier says front-line clinical services are unaffected
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
-
LastPass hit with ICO fine after 2022 data breach exposed 1.6 million users – here’s how the incident unfoldedNews The impact of the LastPass breach was felt by customers as late as December 2024
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
Trend Micro issues warning over rise of 'vibe crime' as cyber criminals turn to agentic AI to automate attacksNews Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations and accelerate attacks.
