Apple image processing vulnerability allows arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Out-of-bounds write in Apple image processing permits arbitrary code execution; reported exploited against targeted individuals.
Apple has disclosed a vulnerability affecting iOS, iPadOS, and macOS devices that permits arbitrary code execution through malicious image file processing. The flaw is an out-of-bounds write issue in image handling code that results in memory corruption when a crafted image is processed. Successful exploitation runs code in the context of the logged-on user; an attacker with administrative privileges could install programs, modify data, or create accounts. Apple has confirmed the vulnerability has been exploited in the wild in a sophisticated, targeted attack against specific individuals, indicating active weaponization.
Affected versions include iOS/iPadOS prior to 18.6.2, iPadOS 17.7.10, macOS Sonoma 14.7.8, macOS Sequoia 15.6.1, and macOS Ventura 13.7.8. Defenders should patch immediately after testing. Mitigations include enforcing least-privilege user accounts, disabling unnecessary file types at mail gateways, enabling system integrity protections (SIP, Gatekeeper), deploying application allowlisting and endpoint detection tools, and maintaining a rigorous vulnerability management process.
Mentioned in this report
Detection guidance
macOS Image Viewer or Image Handling Process Spawning Shell or Script Interpreter
Detects macOS image-handling processes (Preview, Quick Look, Photos, imagent) spawning shells, scripting interpreters or download tools, which may indicate exploitation of an image-parsing memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Image Viewer or Image Handling Process Spawning Shell or Script Interpreter
id: a7034330-3a14-543a-b737-3a1dc83034b3
status: experimental
description: Detects macOS image-handling processes such as Preview, Quick Look helpers,
Photos and imagent spawning shells, scripting interpreters or download utilities.
These processes rarely launch such children, so this may indicate successful exploitation
of an image-parsing memory-corruption vulnerability (for example an out-of-bounds
write in image handling code) that leads to code execution in the user context.
The rule does not match the exploit file itself, only the post-exploitation process
behaviour.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apple-products-could-allow-for-arbitrary-code-execution_2025-075
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|endswith:
- /Preview
- /quicklookd
- /QuickLookUIService
- /Photos
- /imagent
selection_child:
Image|endswith:
- /bash
- /sh
- /zsh
- /osascript
- /python
- /python3
- /perl
- /ruby
- /curl
- /nscurl
condition: selection_parent and selection_child
falsepositives:
- Preview or Photos export plugins and Automator or Quick Actions that invoke shell
scripts on image files
- Third-party Quick Look generator plugins that shell out to helper scripts
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apple-products-could-allow-for-arbitrary-code-execution_2025-075
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs