HIGH

CVE-2025-43529

Apple Safari 2025-12-17 CVSS v3.1

CVSS

8.8

KEV

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Summary dbcve.org

A use-after-free vulnerability in WebKit allows processing of maliciously crafted web content to lead to arbitrary code execution. This memory management flaw affects Safari and iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Apple reports this was exploited in extremely sophisticated attacks against specific targeted individuals on pre-iOS 26 versions.

Mitigation

Apply the available security updates (Safari 26.2, iOS 18.7.3/26.2 and later) to all affected Apple devices to prevent exploitation.

Weakness (CWE)

CWE-416 Use After Free

EPSS Score

8.76%

Probability of exploitation in next 30 days

94.9th percentile

References

https://support.apple.com/en-us/125884 Release Notes, Vendor Advisory https://support.apple.com/en-us/125885 Release Notes, Vendor Advisory https://support.apple.com/en-us/125886 Release Notes, Vendor Advisory https://support.apple.com/en-us/125889 Release Notes, Vendor Advisory https://support.apple.com/en-us/125890 Release Notes, Vendor Advisory https://support.apple.com/en-us/125891 Release Notes, Vendor Advisory https://support.apple.com/en-us/125892 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE