CVE-2025-43529

HIGHCVSS 8.8Known Exploited

CISA Known Exploited Vulnerability

https://support.apple.com/en-us/125884 ; https://support.apple.com/en-us/125892 ; https://support.apple.com/en-us/125885 ; https://support.apple.com/en-us/125886 ; https://support.apple.com/en-us/125889 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43529

Remediation deadline: January 5, 2026

Description

Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Timeline

Published:December 17th, 2025 9:16 PM

Last modified:October 7th, 2026 11:10 AM

Added to KEV:December 15th, 2025

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

apple

Products

safariipadosiphone_osmacostvosvisionoswatchos

Weaknesses (CWE)

CWE-416

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute