CVE-2025-43214
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Analysis
Safari and related Apple platforms crash when processing maliciously crafted web content due to improper memory handling in a buffer overflow condition (CWE-119). The vulnerability affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger denial of service by hosting or injecting malicious web content that causes an unexpected browser crash. No public exploit code or active exploitation has been confirmed at time of analysis, though the low EPSS score (0.15%) suggests minimal real-world exploitation likelihood despite the moderate CVSS 6.5 severity.
Technical Context
This vulnerability is a buffer overflow (CWE-119) in memory handling within Safari's web content processing engine, affecting all Apple platforms that use the WebKit rendering engine (iOS, iPadOS, macOS, tvOS, visionOS, and watchOS). The flaw exists in how Safari parses or processes specially crafted web content, likely in HTML, JavaScript, or CSS parsing routines. When a user navigates to or views malicious web content, the improper memory bounds checking allows data to overflow a buffer, corrupting the memory heap or stack and causing a crash. The attack requires only network access and user interaction (clicking a link or visiting a webpage), making it accessible to remote attackers without authentication.
Affected Products
Apple Safari versions prior to 18.6; Apple iOS versions prior to 18.6; Apple iPadOS versions prior to 18.6; Apple macOS Sequoia versions prior to 15.6; Apple tvOS versions prior to 18.6; Apple visionOS versions prior to 2.6; and Apple watchOS versions prior to 11.6. Security advisories are available at https://support.apple.com/en-us/124147 (Safari), https://support.apple.com/en-us/124149 (iOS), https://support.apple.com/en-us/124152 (iPadOS), https://support.apple.com/en-us/124153 (macOS Sequoia), https://support.apple.com/en-us/124154 (tvOS), https://support.apple.com/en-us/124155 (visionOS), and corresponding watchOS advisory.
Remediation
Update to Apple Safari 18.6 or later; update iOS to 18.6 or later; update iPadOS to 18.6 or later; update macOS Sequoia to 15.6 or later; update tvOS to 18.6 or later; update visionOS to 2.6 or later; and update watchOS to 11.6 or later. Vendor-released patches are available across all affected platforms via Apple's standard security update mechanism. Until patching can be completed, users should avoid clicking untrusted links or visiting untrusted websites to minimize crash risk, though no workaround fully mitigates the vulnerability. For detailed patch information and advisory confirmation, refer to https://support.apple.com/en-us/124147 and related platform-specific advisories listed above.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today