PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reverse engineering of Apple's iOS 0-click CVE-2025-43300: 2 bytes that make size matter

blog.quarkslab.com | vulnerability | Critical | Actively exploited | CVE-2025-43300 | #reverse-engineering | #ios | #apple | #cve-2025-43300 | #imageio | #zero-click
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's root-cause analysis of CVE-2025-43300, the iOS ImageIO out-of-bounds write exploited in zero-click campaigns; patch diffing points to RawCamera and DNG parsing.
CVE
CVE-2025-43300
CVSS
10
Published
Collected

Related coverage

vulnerability · calif.io
CVE-2026-86950: The Great Glyph Grift
# CVE-2026-86950: The Great Glyph Grift An in-the-wild iOS bug with a possible WhatsApp zero-click path. Dion Blazakis, Josh Maine, and Anna Groza September 30, 2026 applemadbugszero-click...
vulnerability · calif.io
[CVE-2026-20643] Reverse engineering Apple's silent security fixes
Diffing a Background Security Improvement to recover the fixes Apple shipped without disclosing them.
vulnerability · calif.io
[CVE-2025-31207] Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild
# Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild Five apps, and what each of them does to stop you attaching a debugger. Huy Nguyen March 17, 2026 applereversing Contents 1....
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
research · calif.io
Apple Internals: Endpoint Security ships in iOS 27.2 beta
# Apple Internals: Endpoint Security ships in iOS 27.2 beta Is antivirus coming to iPhone? Josh Maine September 18, 2026 apple Contents 1. Apple Internals: Endpoint Security ships in iOS 27.2 beta...
research · calif.io
WeWorm
# WeWorm The first zero-click worm to spread through WeChat calls across iOS and Android. Calif Research September 8, 2026 Covered by The New York Times on September 8 and September 11...
Back