Apple Issues Emergency Patch for CVE202543300 Image IO Flaw

Apple has released emergency software updates to fix a zero-day vulnerability, CVE202543300, that has been exploited in what the company described as an extremely sophisticated attack targeting specific individuals. The flaw, an out-of-bounds write in the Image IO framework used by iOS, iPadOS and macOS, could cause memory corruption when processing a malicious image file. Apple said the issue may have been exploited in the wild and urged users to apply the updates promptly.

The vulnerability centers on Image IO, a framework that handles a wide range of image file formats and metadata. An attacker who can persuade a device to process a specially crafted image could trigger memory corruption, potentially enabling remote code execution. Apple confirmed that the fix involved strengthened bounds checking to prevent out-of-bounds writes during image processing. The company also noted that, while it has not disclosed technical details to avoid facilitating further abuses, the vulnerability could be triggered by images delivered through common channels such as text messages, emails or web pages.

The updates reach a broad array of devices and operating system versions. For mobile...