Apple has rolled out iOS 18.6.2 for iPhone, and this isn’t just another routine update. It fixes a serious security vulnerability that Apple says may have already been exploited in highly targeted attacks. If you own an iPhone or iPad, you should install it as soon as possible.
What’s fixed in iOS 18.6.2
The update addresses a flaw in ImageIO, the framework that handles image files on your device. According to Apple, a maliciously crafted image could trigger memory corruption and allow attackers to execute code on your iPhone.
In plain English: simply opening the wrong picture could put your device at risk.
Apple’s security notes confirm that this bug (CVE-2025-43300) was discovered internally and has already been used in “extremely sophisticated” attacks aimed at a small number of people. While most users likely weren’t targets, it’s still critical to update.
Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Devices Affected
The patch is available for:
- iPhone XS and later
- iPad Pro 13-inch and 12.9-inch (3rd gen and newer)
- iPad Pro 11-inch (1st gen and newer)
- iPad Air (3rd gen and newer)
- iPad mini (5th gen and newer)
- iPad (7th gen and newer)
Alongside iOS 18.6.2, Apple also released:
- iPadOS 18.6.2
- iPadOS 17.7.10
- macOS Sequoia 15.6.1
- macOS Ventura 13.7.8
All of these include the same ImageIO fix.
How to Update Right Now
On iPhone or iPad:
- Open Settings
- Go to General > Software Update
- Download and install iOS 18.6.2
On Mac:
- Open System Settings
- Go to General > Software Update
- Install the available update
Why You Should Act Quickly
While you probably weren’t targeted by this vulnerability, Apple’s wording makes it clear that the exploit is out there. Updating closes the hole immediately and keeps your iPhone, iPad, and Mac safe from potential attacks.
Comments