CVE-2025-43211
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing web content may lead to a denial-of-service.
Analysis
Denial-of-service vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS through improper memory handling during web content processing. Local attackers without authentication can trigger this vulnerability via crafted web content to cause application crashes. Vendor-released patches are available across all affected platforms; EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite the moderate CVSS 6.2 rating.
Technical Context
This vulnerability resides in Apple's WebKit rendering engine, which processes HTML, CSS, and JavaScript content across all Apple platforms. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that memory allocation is insufficiently constrained during web content rendering. An attacker can craft malicious web content that triggers excessive or uncontrolled memory allocation, leading to resource exhaustion and denial-of-service. The local attack vector (AV:L) and low complexity (AC:L) indicate the vulnerability requires local access or interaction with local web content, rather than remote network exploitation.
Affected Products
Apple Safari (all versions prior to 18.6), Apple iOS (all versions prior to 18.6), Apple iPadOS (versions prior to 18.6 and 17.7.9), Apple macOS Sequoia (prior to 15.6), Apple tvOS (prior to 18.6), Apple visionOS (prior to 2.6), and Apple watchOS (prior to 11.6). Vendor advisories are available at https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124148, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124152, https://support.apple.com/en-us/124153, https://support.apple.com/en-us/124154, and https://support.apple.com/en-us/124155.
Remediation
Vendor-released patches are available: update Safari to version 18.6 or later, update iOS to 18.6 or later, update iPadOS to 18.6 or later (or 17.7.9 for devices not eligible for version 18), update macOS Sequoia to 15.6 or later, update tvOS to 18.6 or later, update visionOS to 2.6 or later, and update watchOS to 11.6 or later. Given that this is a local memory handling issue affecting web content rendering, no workarounds are available other than avoiding untrusted web content. All remediation steps and advisory links are available from Apple's official support pages referenced above.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today