CVE-2025-43209
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Analysis
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code execution via maliciously crafted web content without user interaction or authentication. Affects iOS, iPadOS, macOS (Ventura through Sequoia), tvOS, visionOS, and watchOS prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating maximum severity, EPSS probability remains low at 0.14% (34th percentile), and no public exploit identified at time of analysis, suggesting limited observed exploitation attempts despite the theoretical remote attack surface.
Technical Context
This vulnerability stems from an out-of-bounds write condition (CWE-787) in WebKit, Apple's browser engine used across all Apple platforms for rendering web content in Safari and embedded web views. Out-of-bounds writes occur when memory is written beyond allocated buffer boundaries, enabling memory corruption that attackers can leverage for arbitrary code execution. The issue affects the web content processing pipeline, where insufficient bounds checking allowed malicious HTML, CSS, or JavaScript to trigger writes outside intended memory regions. The vulnerability exists in WebKit components shared across iOS 18.x, iPadOS 17.x/18.x, macOS 13.x (Ventura), 14.x (Sonoma), and 15.x (Sequoia), tvOS 18.x, visionOS 2.x, and watchOS 11.x, indicating a core flaw in shared rendering engine code predating the platform-specific implementations.
Affected Products
The vulnerability affects multiple Apple operating systems prior to July 2025 security updates: iOS versions before 18.6, iPadOS versions before 17.7.9 and 18.6, macOS Ventura versions before 13.7.7, macOS Sonoma versions before 14.7.7, macOS Sequoia versions before 15.6, tvOS versions before 18.6, visionOS versions before 2.6, and watchOS versions before 11.6. All products share the vulnerable WebKit browser engine component used for web content rendering. Vendor security advisories are available at support.apple.com references 124147 through 124155 covering the respective platform updates.
Remediation
Apply vendor-released patches immediately by updating to the fixed versions: iOS 18.6, iPadOS 17.7.9 or 18.6 (depending on device model), macOS Ventura 13.7.7, macOS Sonoma 14.7.7, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, or watchOS 11.6. Updates can be installed through system Settings > General > Software Update on respective devices. Organizations managing Apple fleets should deploy updates via MDM solutions. Detailed security content is documented in Apple support articles at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155. No workarounds are provided; patching is the only mitigation as the vulnerability exists in core web rendering functionality that cannot be disabled without breaking Safari and embedded web view functionality across applications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today