This paper analyzed the 2025 WhatsApp–ImageIO zero-click exploit chain (CVE-2025-55177 + CVE-2025-43300), which compromised the mobile devices of fewer than 200 targeted individuals without any user interaction. Through a three-axis framework (root cause, patch, chain position), we reconstructed how a WhatsApp linked-device authorization bypass (CWE-863) delivered a crafted DNG image to Apple’s ImageIO framework, where a two-byte inconsistency between TIFF metadata and an embedded JPEG marker triggered a heap out-of-bounds write (CWE-787) leading to remote code execution.
Three findings emerge. First, the fundamental exploitation primitive (a heap buffer overflowed into an adjacent function pointer) is identical to the one demonstrated in the educational Phoenix heap-two exercise. The difference between a textbook CTF exercise and a production zero-click chain is engineering (heap grooming, ASLR bypass, PAC bypass), not mechanism. Second, the 2025 chain reproduces the architectural pattern of FORCEDENTRY (2021) with different components (a different messenger, a different parser, a different image format) but the same structural vulnerability. The recurrence across four years and two independent ecosystems suggests that the pattern is inherent to the current architecture of media processing on mobile platforms, not an isolated accident. Third, the deployed mitigation stack (ASLR, stack canaries, sandboxing, PAC) addresses symptoms rather than the root cause: none of these defenses prevent the out-of-bounds write itself, and analogous kernel-level mitigations (SMAP, SMEP, KASLR) did not prevent Copy Fail [15] or DirtyFrag [16], two further write-primitive root exploits disclosed in April and May 2026 - confirming that the finding is not iOS-specific but a property of the current mitigation-oriented paradigm.
We recommend two structural interventions. The near-term priority is incremental rewriting of high-exposure C/C++ parsers (ImageIO, CoreGraphics, and their Android equivalents) in memory-safe languages such as Rust or Swift. The longer-term intervention is deployment of hardware-enforced memory tagging (ARM MTE) on iOS, which would make heap overflows detectable at the granule level regardless of the implementation language.
References
- [15] Microsoft Threat Intelligence, “CVE-2026-31431: Copy Fail Vulnerability Enables Linux Root Privilege Escalation”, Microsoft Security Blog, 2026.↩
- [16] Wiz Research, “DirtyFrag: Linux Kernel Local Privilege Escalation via ESP and RxRPC (CVE-2026-43284)”, Wiz security blog, 2026.↩