Executive brief
Apple iOS, iPadOS, and macOS are affected by a critical security flaw in the framework responsible for processing images. By tricking a user into opening or viewing a specially crafted image file, an attacker could corrupt the device's memory to gain unauthorized control. This vulnerability has been actively exploited in highly targeted attacks against specific individuals.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in Apple's Image I/O framework due to insufficient bounds checking. The flaw is triggered when the system processes a maliciously crafted image file, leading to memory corruption. This can be exploited remotely without user interaction in some contexts (e.g., automated thumbnail generation) to achieve arbitrary code execution. Apple has confirmed reports of active exploitation in the wild. The issue was addressed by improving input validation and bounds checking across multiple operating system versions.
Affected products
- Apple iOS < 15.8.5, 16.0 to < 16.7.12, 17.0 to < 18.6.2
- Apple iPadOS < 15.8.5, 16.0 to < 16.7.12, 17.0 to < 17.7.10, 18.0 to < 18.6.2
- Apple macOS Sequoia < 15.6.1
- Apple macOS Sonoma 14.0 to < 14.7.8
- Apple macOS Ventura 13.0 to < 13.7.8
Timeline
- 2025-08-21: advisory: Initial disclosure and CISA KEV addition
- 2025-08-21: exploited: Apple reported awareness of targeted exploitation in the wild
- 2025-08-21: patched: Fixes released in various OS updates including iOS 18.6.2 and macOS 15.6.1