The Discovery 🔗CVE-2025-43300 represents one of those subtle yet devastating vulnerabilities that security researchers dream (or have nightmares) about. According to Apple’s official advisory, this out-of-bounds write issue was discovered in their implementation of JPEG Lossless Decompression code within the RawCamera.bundle, which processes Adobe’s DNG (Digital Negative) files. What elevates this from a typical vulnerability to a critical threat is Apple’s chilling acknowledgment: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.” This isn’t theoretical - it’s been weaponized.

This is the last part of a 3-part series on Bob and Alice in Kernel-land. You can find Part 1 here and Part 2 here. CrowdStrike podcast “Adversary Universe Podcast” just released a new episode entitled “The Kernel’s Essential Role in Cybersecurity Defense” featuring Adam Myers w/ Alex Ionescu, who is the original architect of the CrowdStrike Falcon kernel agent and also known for being the co-author of “Windows Internals” book and to be among the most knowledgeable people when it comes to understanding how the Windows (or any other OS tbh) kernel works.

It’s been a month since I wrote Part 1 of “Bob and Alice in Kernel-land”. As expected, we saw minimal constructive feedback from vendors, with a few notable exceptions. Sophos provided the most detailed information about their drivers, while CrowdStrike offered valuable insights into their kernel architecture, including the use of Microsoft’s Winsock kernel file transfer. This feature, introduced in Windows Vista+, was designed to replace the outdated Transport Driver Interface (TDI). It’s reasonable to assume that the existence of this capability has significantly contributed to more operations being moved to kernel mode, as leveraging TDI posed considerable challenges without compromising stability.