PoC Exploit and Technical Analysis Published for Apple Zero-Day RCE Vulnerability

A newly disclosed critical zero-click exploit (CVE-2025-43300) poses a serious threat to Apple devices. The flaw exists in Apple’s RawCamera.bundle, specifically within the JPEG Lossless Decompression implementation, and allows attackers to execute arbitrary code by sending maliciously crafted DNG (Digital Negative) files.

What makes this vulnerability alarming is that no user interaction is required. Simply receiving a malicious image through iMessage, AirDrop, or photo import can trigger the exploit.

Key Takeaways

1. Remote Code Execution (RCE) can be achieved via malicious DNG files.
2. The flaw has already been observed in real-world targeted attacks.
3. Users should update immediately to iOS 18.6.2 or later for protection.

Technical Overview

Security researcher b1n4r1b01 published a detailed proof-of-concept (PoC) and analysis of the vulnerability. The issue arises from a buffer overflow condition in Apple’s RawCamera.bundle when processing DNG images with JPEG lossless compression.

The exploit leverages a metadata mismatch:

• The DNG file declares SamplesPerPixel = 2 in its SubIFD directory.
• However, the embedded JPEG SOF3 (Start of Frame 3) block contains only 1 component.

This inconsistency forces the decompression routine to write data outside allocated memory boundaries, enabling attackers to corrupt memory and run arbitrary code.

Proof-of-Concept Details

The PoC exploit requires minimal modification of a legitimate DNG file. Attackers only need to alter two bytes:

• At offset 0x2FD00, change 01 → 02 (modifies SamplesPerPixel).
• At offset 0x3E40B, change 02 → 01 (alters SOF3 component count).

These small changes create the precise mismatch that triggers the vulnerability.

Impact and Risk Factors

Why It’s Dangerous

The zero-click nature of this exploit makes it especially attractive for surveillance campaigns and state-sponsored attacks. Victims don’t need to click, open, or interact with the malicious file — just receiving it is enough.

Apple has confirmed that this flaw was already exploited in the wild before the patch release, making it a weaponized threat actor tool rather than a theoretical risk.

Mitigation

Apple has patched the issue in:

• iOS 18.6.2
• iPadOS 18.6.2
• macOS Sequoia 15.6.1
• Updates for earlier macOS versions

Organizations and individuals should apply updates immediately and deploy detection mechanisms to monitor for suspicious DNG processing activity.

IOCs (Indicators of Compromise)