Apple has released emergency updates to fix a critical zero-day out-of-bounds write vulnerability in the ImageIO framework that has been actively exploited in what the company described as “extremely sophisticated” attacks against targeted individuals. The flaw, tracked as CVE-2025-43300, which can cause memory corruption and potentially allow remote code execution (RCE) when processing malicious images, was internally discovered and patched through improved bounds checking. Updates have been issued across iOS 18.6.2, iPadOS 18.6.2 and 17.7.10, and macOS Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8, covering a wide range of iPhones, iPads, and Macs. While the attackers and victims remain unidentified, Apple emphasized the critical nature of promptly applying the fixes. This marks the company’s seventh zero-day patched in 2025, following six (6) others exploited earlier this year, and comes shortly after a Safari flaw (CVE-2025-6558) linked to Chrome zero-day exploitation was also addressed. CTIX analysts urge all readers using Apple products to always ensure that their devices are up-to-date with the most recent software to prevent exploitation.