Apple Patches Zero-Day Flaw Used in 'Sophisticated' Attack

Apple patched CVE-2025-43300, an out-of-bounds write in the ImageIO framework that could cause memory corruption when processing a malicious image and was reportedly exploited in an "extremely sophisticated" targeted attack against specific individuals; the flaw affects iOS, iPadOS, and macOS and was fixed via improved bounds checking. Apple released few technical details, and the report contextualizes this fix within a series of zero-day disclosures and past exploitation by commercial spyware vendors such as Paragon Solutions and NSO Group.