# Apple image processing vulnerability allows arbitrary code execution

Published: 2026-06-09 · Severity: high · Sectors: government-national, technology
Canonical: https://vorant.io/reports/4a9e1f5f-4fb6-5cdd-b791-4654ac33d661/apple-image-processing-vulnerability-allows-arbitrary-code-execution

> Out-of-bounds write in Apple image processing permits arbitrary code execution; reported exploited against targeted individuals.

Apple has disclosed a vulnerability affecting iOS, iPadOS, and macOS devices that permits arbitrary code execution through malicious image file processing. The flaw is an out-of-bounds write issue in image handling code that results in memory corruption when a crafted image is processed. Successful exploitation runs code in the context of the logged-on user; an attacker with administrative privileges could install programs, modify data, or create accounts. Apple has confirmed the vulnerability has been exploited in the wild in a sophisticated, targeted attack against specific individuals, indicating active weaponization.

Affected versions include iOS/iPadOS prior to 18.6.2, iPadOS 17.7.10, macOS Sonoma 14.7.8, macOS Sequoia 15.6.1, and macOS Ventura 13.7.8. Defenders should patch immediately after testing. Mitigations include enforcing least-privilege user accounts, disabling unnecessary file types at mail gateways, enabling system integrity protections (SIP, Gatekeeper), deploying application allowlisting and endpoint detection tools, and maintaining a rigorous vulnerability management process.

## Mentioned in this report

- Vulnerabilities: CVE-2025-43300 (KEV)

## Detection guidance (public sample)

### macOS Image Viewer or Image Handling Process Spawning Shell or Script Interpreter

ATT&CK: T1203

Detects macOS image-handling processes (Preview, Quick Look, Photos, imagent) spawning shells, scripting interpreters or download tools, which may indicate exploitation of an image-parsing memory-corruption flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Image Viewer or Image Handling Process Spawning Shell or Script Interpreter
id: a7034330-3a14-543a-b737-3a1dc83034b3
status: experimental
description: Detects macOS image-handling processes such as Preview, Quick Look helpers,
  Photos and imagent spawning shells, scripting interpreters or download utilities.
  These processes rarely launch such children, so this may indicate successful exploitation
  of an image-parsing memory-corruption vulnerability (for example an out-of-bounds
  write in image handling code) that leads to code execution in the user context.
  The rule does not match the exploit file itself, only the post-exploitation process
  behaviour.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apple-products-could-allow-for-arbitrary-code-execution_2025-075
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
    - /Preview
    - /quicklookd
    - /QuickLookUIService
    - /Photos
    - /imagent
  selection_child:
    Image|endswith:
    - /bash
    - /sh
    - /zsh
    - /osascript
    - /python
    - /python3
    - /perl
    - /ruby
    - /curl
    - /nscurl
  condition: selection_parent and selection_child
falsepositives:
- Preview or Photos export plugins and Automator or Quick Actions that invoke shell
  scripts on image files
- Third-party Quick Look generator plugins that shell out to helper scripts
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apple-products-could-allow-for-arbitrary-code-execution_2025-075

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4a9e1f5f-4fb6-5cdd-b791-4654ac33d661/apple-image-processing-vulnerability-allows-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup