Apple Safari
CVE-2025-43501
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
ExploitVictim loads content in Safari/WebKit
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactCrash rendering process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open or render attacker-controlled ('maliciously crafted') web content in Safari or any WebKit-based component on an affected Apple OS (macOS Tahoe pre-26.2, iOS/iPadOS pre-18.7.3 or pre-26.2, visionOS pre-26.2). Exploitation is remote and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R) - the user must navigate to or load the malicious content; there is no automatic/wormable trigger. The realistic outcome is limited to an unexpected process (renderer/tab) crash - a recoverable denial of service - with no code execution, data theft, or system compromise. |
| Impact | This is a low-priority availability-only issue despite affecting ubiquitous Apple software. The CVSS 3.1 base score is 4.3 (Medium-low), and critically the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L confirms the ONLY impact is a single-process crash (A:L) - no confidentiality or integrity impact. The description ('may lead to an unexpected process crash') aligns exactly with the A:L/C:N/I:N vector: this is a denial-of-service (tab/renderer crash), not memory-corruption code execution, even though the root cause is a CWE-787 out-of-bounds write / buffer overflow. Exploitation status: no public exploit identified at time of analysis - not in CISA KEV, and no POC referenced. EPSS is 0.77% (54th percentile), which is unremarkable and consistent with a non-RCE crash bug rather than a widely-weaponized flaw. No SSVC data was provided. The signals are internally consistent: high prevalence of the affected platform is offset by trivial real-world impact (recoverable crash) and the requirement for user interaction (UI:R - victim must load malicious web content). This is a routine WebKit hardening fix, not an emergency. |
| Exploit ScenarioDerived | An attacker hosts a web page containing maliciously crafted content and lures a victim into visiting it in Safari or any WebKit-based view on an affected Apple device (macOS, iOS, iPadOS, visionOS). When WebKit processes the content, the out-of-bounds write triggers an unexpected crash of the rendering process. No public exploit code is known, and the impact is limited to a denial of service (crash), not code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write (memory corruption) in Apple's WebKit rendering engine lets remote, unauthenticated attackers crash Safari and other WebKit-based components on affected Apple platforms by convincing a victim to load maliciously crafted web content. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L vector, the realistic outcome is limited to an unexpected process (tab/renderer) crash - a recoverable availability-only denial of service - with no code execution, data disclosure, or integrity impact, and exploitation requires mandatory victim interaction (navigating to or rendering the attacker-controlled content) with no automatic or wormable trigger. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.77% (54th percentile), and Apple has released fixes in Safari 26.2, iOS and iPadOS 18.7.3 and 26.2, macOS Tahoe 26.2, and visionOS 26.2.
RemediationAI
Vendor-released patches: upgrade to Safari 26.2 on macOS, iOS 18.7.3 or iOS 26.2 (and the matching iPadOS 18.7.3 / 26.2 builds), macOS Tahoe 26.2, and visionOS 26.2 - see the Apple advisories at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125885, https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125891, and https://support.apple.com/en-us/125892 for the applicable download. Because the issue is availability-only and gated by user interaction, patching can be scheduled on a routine cadence rather than emergency; until then, the practical mitigations are to enable Safari Lockdown Mode or disable JavaScript on high-risk browsing profiles, both of which reduce the attack surface of the WebKit parser at the cost of broken or degraded functionality on many legitimate sites, and to enforce web content filtering, DNS blocking of untrusted domains, or hardened enterprise browsing policies whose trade-off is limited effectiveness against targeted, novel malicious content. No fully reliable workaround exists short of the vendor updates, since any WebKit-rendering surface remains reachable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a buffer overflow in Apple's WebKit engine, classified as CWE-787 (out-of-bounds write), which Apple addressed through improved memory handling. WebKit is the shared rendering and JavaScript engine behind Safari on macOS and behind the WebView/WebKit components used across iOS, iPadOS, and visionOS, so a single memory-safety defect in the engine is reachable from any code path that parses or renders web content on those platforms. The CPE inventory maps the exposure to cpe:2.3:a:apple:safari, and to the operating-system entries cpe:2.3:o:apple:iphone_os (iOS), cpe:2.3:o:apple:ipados (iPadOS, listed twice for the two patched release trains), cpe:2.3:o:apple:macos, and cpe:2.3:o:apple:visionos. Based on the provided vector (AV:N, PR:N, UI:R, S:U, C:N/I:N/A:L), the out-of-bounds write is triggerable over the network without credentials but only inside the context of rendering attacker-supplied content that the user must actively load, and the demonstrated consequence is confined to an isolated, recoverable process crash rather than memory corruption that yields control-flow hijack, sandbox escape, or data exfiltration.
Know when Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Remote web content (AV:N), no auth (PR:N) but requires the victim to load the page (UI:R); impact is a single-process crash only, so A:L with C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
DescriptionCVE.org
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
GitHub PoC
Exploit-DB