CVE-2025-43529

Actively exploited (CISA KEV) High 8.8 CVSS 3.1

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Description as published by the source, in English.

Key facts

Published: 2025-12-17
Last modified: 2026-10-07
Assigned by: product-security@apple.com
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Scored by: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Probability of exploitation: 8.6 % higher than 95 % of all known vulnerabilities
EPSS, next 30 days, model v2026.06.15
Fix available: Not registered in the sources

Actively exploited

CISA added this vulnerability to the Known Exploited Vulnerabilities catalogue on 2025-12-15, with a remediation deadline of 2026-01-05 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products

Vendor	Product	Versions	Status
Apple	Ipados	< 18.7.3	Affected
Apple	Ipados	≥ 26.0, < 26.2	Affected
Apple	Iphone Os	< 18.7.3	Affected
Apple	Iphone Os	≥ 26.0, < 26.2	Affected
Apple	Macos	≥ 26.0, < 26.2	Affected
Apple	Safari	< 26.2	Affected
Apple	Tvos	< 26.2	Affected
Apple	Visionos	< 26.2	Affected
Apple	Watchos	< 26.2	Affected

Weakness type

CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within…

References

https://support.apple.com/en-us/125884 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125885 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125886 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125889 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125890 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125891 Release Notes, Vendor Advisory
https://support.apple.com/en-us/125892 Release Notes, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529 US Government Resource

Related at Berigo

Articles

Apple rushes out update for two WebKit zero-days Mentions this CVE 2025-12-12
Apple has closed two WebKit zero-days already used in targeted attacks against specific individuals on older iOS releases.
A malicious web page can run commands on machines running Ray Same product 2026-08-18
On 17 August 2026 CISA added CVE-2025-62593 to its catalog of known exploited vulnerabilities. The flaw sits in the Ray compute engine, and lets a ma…
Older iPhones got 122 security flaws fixed in a single update Same product 2026-08-18
Apple shipped four security updates on 17 August 2026. The update for the older system line covers only four hardware models, and fixes 122 unique CV…
Attackers are logging in to Macs without a password through Screen Sharing Same product 2026-08-15
Apple shipped an emergency fix for macOS Screen Sharing after a flaw that lets an attacker on the network log in without valid credentials. The Dutch…

Does this affect you?

A vulnerability matters only if you run the product, in an affected version, somewhere an attacker can reach.

Check your asset list Browse all vulnerabilities

Sources and freshness

CVE

What it is: A reference number naming one specific vulnerability, for example CVE-2024-9474.
What it tells you: Which vulnerability we are talking about, and in which product.
What it does NOT tell you: Nothing about how serious it is, whether anyone is exploiting it, or whether it concerns you.
Why it matters: Without a shared number, vendor, authority and tooling cannot discuss the same flaw.
Used with the others: The number is the key. NVD, KEV and EPSS all describe the same CVE.

NVD CWE CISA KEV EPSS

How to read this together

No single value should be used on its own. A high CVSS score does not mean a vulnerability is being exploited, and a low one does not mean it is harmless. The four sources answer four different questions.

CVE names the specific vulnerability.
NVD adds severity and technical detail about it.
CWE describes the type of mistake behind it.
CISA KEV shows that it is already being exploited.
EPSS estimates how likely exploitation is soon.

The order that decides what is urgent

Do you actually have the product?
Is the version you run affected?
Is it listed in CISA KEV?
Does it have a high EPSS score?
Is the system reachable from the internet or from others?
How important is the system to the business?
Are there compensating controls already in place?

The first two questions are not about the vulnerability at all. They are about you, and they remove most of the list before you start.

A short example

Fix this week

CVSS 6,5 (medium)

In CISA KEV: yes
EPSS: 94 per cent
A firewall facing the internet

Can be scheduled

CVSS 9,8 (critical)

In CISA KEV: no
EPSS: 0,04 per cent
A test server with no internet access

Sorted by CVSS alone, the one on the right comes first. It is the more serious flaw in theory. But the one on the left is being used against real organisations right now, and it sits where an attacker can reach it. That is the one to fix first.

The critical one still has to be fixed. It just does not have to be fixed today.

This product uses the NVD API but is not endorsed or certified by the NVD. CVE and the CVE logo are registered trademarks of The MITRE Corporation; CVE records are used under the CVE Terms of Use. CWE is a trademark of The MITRE Corporation, used per the CWE Terms of Use. KEV data from CISA (CC0). Exploitation probability from EPSS, a FIRST.org project. Open-source package data from OSV and the GitHub Advisory Database (CC-BY 4.0).

Scores and vectors are shown as published by the sources. The ordering of results is Berigo's own editorial assessment, described on the search page, and is not NVD data. An empty result never means a system is safe.