Apple 0-Day RCE Vulnerability: PoC Exploit and Analysis Released

A detailed proof-of-concept exploit and vulnerability analysis for CVE-2025-43300, a critical zero-click remote code execution vulnerability affecting Apple devices.

The vulnerability, which Apple acknowledges may have been exploited in sophisticated targeted attacks, represents one of the most dangerous iOS vulnerabilities discovered in recent years.

CVE-2025-43300 exploits a fundamental vulnerability in Apple’s implementation of JPEG Lossless Decompression code within the RawCamera.bundle, specifically when processing Adobe DNG (Digital Negative) files.

The vulnerability stems from an inconsistency between metadata declarations and actual image data, creating an out-of-bounds write condition that attackers can leverage for remote code execution.

The attack vector is particularly concerning because it requires no user interaction whatsoever.

When a malicious DNG file is received through iMessage or other messaging platforms, iOS automatically processes the image for preview generation, triggering the vulnerability silently in the background.

This zero-click nature makes the exploit extremely valuable to threat actors, as victims remain completely unaware of the compromise.

Researcher b1n4r1b01 documented the technical details, explaining that the vulnerability occurs when a DNG file declares it has 2 samples per pixel in its SubIFD metadata while the actual JPEG Lossless data contains only 1 component in its SOF3 marker.

This mismatch causes the decompression routine to write beyond allocated buffer boundaries, leading to memory corruption that can be weaponized for code execution.

Apple 0-Day RCE Vulnerability

The vulnerability affects a comprehensive range of Apple devices and operating systems.

Apple released patches across iOS 18.6.2, iPadOS 18.6.2, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8, and iPadOS 17.7.10.

The broad scope of affected systems underscores the critical nature of this vulnerability, as it impacts virtually every modern Apple device in circulation.

What makes this vulnerability particularly alarming is Apple’s rare acknowledgment that it “may have been exploited in an extremely sophisticated attack against specific targeted individuals.”

This language typically indicates that the vulnerability has been actively used by advanced persistent threat groups or nation-state actors in real-world attacks, elevating its severity beyond theoretical concerns.

The technical complexity of the exploit suggests it was likely developed by highly skilled attackers with deep knowledge of Apple’s image processing infrastructure.

The fact that the vulnerable code resides in RawCamera.bundle, which processes various raw image formats, makes it an attractive target for attackers seeking a reliable entry point into iOS devices.

Mitigations

In response to the threat, security researcher Matt Suiche developed ELEGANT BOUNCER, an open-source Rust-based detection tool specifically designed to identify CVE-2025-43300 exploit attempts.

The tool analyzes DNG files for the telltale signs of exploitation by parsing TIFF structures, identifying JPEG Lossless compression, and detecting the critical mismatch between SamplesPerPixel declarations and SOF3 component counts.

Organizations can implement several defensive measures beyond applying Apple’s patches. These include deploying file validation systems before processing DNG files, using detection tools like ELEGANT BOUNCER for suspicious content analysis, and disabling automatic image preview for untrusted sources when possible.

The release of both the technical analysis and detection tools provides the security community with comprehensive resources to understand and defend against this sophisticated attack vector.

The vulnerability serves as a stark reminder that file format parsing remains a lucrative target for attackers, particularly in an era where automatic content processing creates vast attack surfaces across mobile messaging platforms.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.