Apple has released an emergency security update to fix a zero-day vulnerability actively exploited by attackers against targeted individuals.

The flaw, tracked as CVE-2025-43300, is an out-of-bounds write defect that allows maliciously crafted image files to trigger memory corruption, potentially giving attackers the ability to compromise devices.

In its advisory, Apple confirmed that the issue had been exploited in the wild.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals,” the company said in its update notes.

CISA Flags the Threat

On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the defect to its Known Exploited Vulnerabilities Catalog, warning federal agencies and organizations to patch immediately.

Apple did not disclose the number of affected users or the scale of active exploits. The company has a history of limiting details about in-the-wild zero-days but has repeatedly flagged cases where nation-state-level or advanced threat actors appear to be behind the attacks.

Expert Analysis

Satnam Narang, senior staff research engineer at cybersecurity firm Tenable, said Apple’s choice of language is significant.

“This language suggests that Apple is being purposeful in its external communication,” Narang said. “While the impact to the wider populace is smaller because the attackers exploiting CVE-2025-43300 had a narrow, targeted focus, Apple wants the public to pay attention to the threat and take immediate action.”

Who Is at Risk?

The vulnerability affects:

• macOS versions before 13.7 and 15.6
• iPadOS versions before 17.7
• iOS/iPadOS versions before 18.6

Apple said it has improved bounds checking to fix the flaw and urged all users running vulnerable software versions to update immediately.

While the likelihood of everyday users being targeted is considered low, Narang noted:

“It’s never zero.”

Ongoing Security Pressure

This marks the fifth zero-day Apple has patched in 2025, following fixes in January, February, March, and April. Overall, Apple vulnerabilities have been added to CISA’s exploited catalog seven times this year, underscoring the tech giant’s ongoing struggle to stay ahead of sophisticated attackers.