CVE-2025-43529
Apple Multiple Products Use-After-Free WebKit Vulnerability
Description
CVE-2025-43529 is a high-severity use-after-free vulnerability affecting multiple Apple products including Safari, iOS, iPadOS, macOS Tahoe, watchOS, visionOS, and tvOS. With a CVSS v3.1 base score of 8.8, this memory corruption flaw can be triggered by processing maliciously crafted web content, leading to arbitrary code execution on the victim's device. Apple has acknowledged that this vulnerability may have been exploited in an extremely sophisticated targeted attack. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 5, 2026. Despite its confirmed exploitation, the EPSS score is relatively low at 0.00026 (6.8th percentile), reflecting the highly targeted nature of the attacks rather than broad exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 26.2 |
| apple | ipados | < 18.7.3; >= 26.0, < 26.2 |
| apple | iphone os | < 18.7.3; >= 26.0, < 26.2 |
| apple | macos | >= 26.0, < 26.2 |
| apple | tvos | < 26.2 |
| apple | visionos | < 26.2 |
| apple | watchos | < 26.2 |
References
- https://support.apple.com/en-us/125884(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125885(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125886(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125889(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125890(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125891(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125892(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-43529 is classified under CWE-416, which describes a condition where a program continues to reference memory after it has been freed. In the context of WebKit, the rendering engine used by Safari and other Apple products, a use-after-free occurs when the engine processes malicious web content that manipulates the DOM or JavaScript objects in a way that causes the engine to access a memory region that has already been deallocated. An attacker can control the contents of the freed memory region through heap manipulation techniques, causing the program to execute attacker-controlled code when it dereferences the stale pointer. Use-after-free vulnerabilities in browser engines are among the most valuable to exploit developers because they provide a reliable path to arbitrary code execution from a remote context. Learn more about CWE-416
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). Successful exploitation allows arbitrary code execution on the target device, which means an attacker gains the ability to read sensitive data, modify system behavior, and potentially crash or take control of the affected application or device. On mobile platforms like iOS, this could lead to access to photos, messages, contacts, location data, and other sensitive personal information.
Business Impact extends across all Apple platforms. The vulnerability affects Safari on macOS, the WebKit engine embedded in iOS and iPadOS (which is used by all browsers on those platforms), watchOS, tvOS, and visionOS. This means a single malicious webpage can potentially compromise any Apple device that renders it. For enterprise environments with Apple device fleets, this represents a significant risk to corporate data accessed through mobile devices.
Exploitation Context is notable for its sophistication. Apple's advisory specifically mentions awareness of exploitation in an "extremely sophisticated attack," suggesting this vulnerability was used by an advanced threat actor, possibly a nation-state or commercial spyware vendor. The low EPSS score of 0.00026 (6.8th percentile) reflects that exploitation has been highly targeted rather than broadly opportunistic. However, now that the vulnerability is publicly disclosed, broader exploitation may follow as less sophisticated actors attempt to replicate the attack.
Exploit Maturity
CVE-2025-43529 has confirmed active exploitation, with Apple explicitly acknowledging awareness of reports that this vulnerability "may have been exploited in an extremely sophisticated attack." This phrasing, commonly used by Apple, typically indicates targeted exploitation by advanced threat actors such as nation-state cyber operations or commercial spyware vendors. CISA has added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 5, 2026.
The EPSS score of 0.00026 (6.8th percentile) is notably low for a KEV-listed vulnerability, reflecting the highly targeted nature of the exploitation rather than mass attacks. This pattern is consistent with vulnerabilities used in surveillance operations where the exploit is deployed against specific individuals rather than broad populations. However, the public disclosure and availability of patched versions enable security researchers and threat actors to identify the vulnerable code path through patch diffing, which may lead to broader exploitation over time. The ransomware association is listed as "Unknown" by CISA. Browser-based code execution vulnerabilities are not typically primary ransomware vectors, but they can serve as initial access mechanisms in sophisticated attack chains.
Remediation
-
Update All Apple Devices to the Latest Versions — Install Safari 26.2, iOS 18.7.3 or iOS 26.2, iPadOS 18.7.3 or iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2, visionOS 26.2, and tvOS 26.2. Apple has published security updates for all affected platforms through the standard software update mechanisms. Refer to Apple's security advisories at support.apple.com for detailed release information.
-
Enable Automatic Updates — Ensure that all Apple devices in your environment have automatic software updates enabled to receive critical security patches as soon as they are available. For managed enterprise environments, push the updates through your MDM solution as a priority deployment.
-
Deploy Content Filtering for High-Risk Users — For users who may be targets of sophisticated attacks (executives, journalists, activists, government officials), consider enabling Apple's Lockdown Mode, which significantly restricts WebKit functionality and reduces the attack surface for browser-based exploits.
-
Monitor for Indicators of Compromise — Review device logs and network traffic for signs of exploitation, particularly unusual web content processing, unexpected process creation after browser activity, or communication with known command-and-control infrastructure. For iOS devices, tools like iMazing or the sysdiagnose process can help identify anomalies.
-
Enforce Web Content Policies — Use enterprise web filtering or DNS-based security services to block access to known malicious domains and implement URL reputation checking to reduce the likelihood of users encountering exploitation attempts in the first place.
Technical Details
CVE-2025-43529 is a use-after-free vulnerability in WebKit, the rendering engine that powers Safari and is embedded in all Apple operating systems for web content processing. The flaw was addressed with improved memory management in the patched versions, indicating that the root cause involved incorrect lifetime management of an object during web content processing.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector indicates high severity requiring user interaction. Attack Vector (AV:N) means the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) indicates no special conditions beyond user interaction are needed. Privileges Required (PR:N) confirms no authentication is necessary. User Interaction (UI:R) means the victim must navigate to a malicious webpage or process attacker-controlled web content. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The attacker hosts or injects maliciously crafted web content (HTML, JavaScript, CSS, or a combination) designed to trigger the use-after-free condition in WebKit. When a victim's browser renders this content, the exploit manipulates object lifecycles to cause the engine to free a memory object while retaining a reference to it. Subsequent access to the freed memory dereferences the stale pointer, and because the attacker has arranged for controlled data to occupy the freed memory region through heap spraying or grooming techniques, the execution flow is redirected to attacker-controlled code. The exploitation chain likely includes additional steps to bypass modern mitigations such as ASLR and pointer authentication codes (PAC) on ARM64 devices, which is consistent with Apple's description of the attack as "extremely sophisticated."
Frequently Asked Questions
Has CVE-2025-43529 been exploited in the wild?
Yes. Apple has acknowledged that this vulnerability "may have been exploited in an extremely sophisticated attack," and CISA has added it to the KEV catalog. The exploitation appears to have been highly targeted rather than broadly deployed, consistent with advanced threat actor operations.
Which Apple products are affected by CVE-2025-43529?
Safari, iOS, iPadOS, macOS Tahoe, watchOS, visionOS, and tvOS are all affected. The vulnerability is in WebKit, the shared web rendering engine across all Apple platforms. Updates are available for Safari 26.2, iOS 18.7.3/26.2, iPadOS 18.7.3/26.2, macOS Tahoe 26.2, watchOS 26.2, visionOS 26.2, and tvOS 26.2.
Why is the EPSS score so low for a KEV-listed vulnerability?
The low EPSS score of 0.00026 (6.8th percentile) reflects the highly targeted nature of the exploitation. Unlike broadly exploited vulnerabilities, CVE-2025-43529 appears to have been used in specific, sophisticated attacks against selected targets rather than in mass exploitation campaigns.
Should I be concerned about CVE-2025-43529 even if I am not a high-profile target?
Yes. While initial exploitation was highly targeted, the public disclosure of the vulnerability means that additional threat actors may develop exploits for broader use. Updating all Apple devices promptly is recommended for all users regardless of their threat profile.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.