Skip to main content

Ipados CVE-2025-43529

HIGH
Use After Free (CWE-416)
2025-12-17 product-security@apple.com
RCE Use After Free Memory Corruption Apple Ipados Iphone Os Tvos Visionos Watchos
8.8
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This represents a critical real-world threat despite moderate EPSS scoring. CISA KEV inclusion confirms active exploitation in sophisticated targeted attacks, elevating priority far beyond the 0.12% EPSS probability which reflects broad opportunistic exploitation likelihood rather than targeted campaign risk. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity requiring only user interaction (visiting a malicious website), making exploitation straightforward once weaponized. SSVC framework assessment: exploitation status is active per KEV, technical impact is total (arbitrary code execution enabling complete device compromise), automatable is yes (web-based delivery requires minimal attacker interaction), yielding an immediate action priority. The UI:R requirement (user must visit attacker-controlled content) provides minimal defensive value in targeted attack scenarios where social engineering, watering hole attacks, or malvertising can reliably deliver payloads. Apple's specific mention of extremely sophisticated attacks against targeted individuals suggests nation-state or advanced persistent threat actor involvement. The simultaneous issuance of CVE-2025-14174 for the same exploitation report indicates potential exploit chaining, further elevating risk. Organizations with high-value individuals using Apple devices face immediate risk.
Exploit ScenarioDerived

An attacker delivers a weaponized website to targeted individuals through spear-phishing emails, SMS messages, or by compromising legitimate websites frequented by targets (watering hole attack). When the victim visits the malicious site using Safari or any app with embedded WebKit rendering, crafted JavaScript and HTML triggers the use-after-free condition during DOM manipulation or rendering operations. The attacker leverages heap grooming techniques to control the contents of the freed memory region, redirecting code execution to attacker-supplied shellcode. Successful exploitation grants complete arbitrary code execution with the privileges of the WebKit process, enabling installation of spyware, exfiltration of sensitive data including messages and credentials, or persistence mechanisms for long-term device compromise. Apple's acknowledgment of extremely sophisticated attacks suggests adversaries combined this WebKit vulnerability with additional exploits (potentially CVE-2025-14174) to achieve full device compromise and bypass platform security protections.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 02, 2026

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2, allowing remote attackers to execute arbitrary code by convincing users to visit malicious websites. This vulnerability is confirmed actively exploited (CISA KEV) in extremely sophisticated targeted attacks against specific individuals on iOS versions prior to iOS 26, per Apple's security bulletin. EPSS score of 0.12% (32nd percentile) significantly understates real-world risk given confirmed exploitation. Related vulnerability CVE-2025-14174 was issued for the same exploitation campaign, suggesting a complex attack chain targeting Apple ecosystem users.

RemediationAI

Immediately update all Apple devices to patched versions released by Apple in their coordinated security update. Install Safari 26.2 on macOS systems via Software Update or direct download from support.apple.com/en-us/125884. Update iOS and iPadOS devices to version 18.7.3 (advisory support.apple.com/en-us/125885) or version 26.2 (advisory support.apple.com/en-us/125886) depending on device compatibility. Update macOS Tahoe to version 26.2 per support.apple.com/en-us/125889. Update tvOS to 26.2 (support.apple.com/en-us/125890), visionOS to 26.2 (support.apple.com/en-us/125891), and watchOS to 26.2 (support.apple.com/en-us/125892). No effective workarounds exist for WebKit vulnerabilities given the engine's deep integration across the operating system; disabling JavaScript would break legitimate functionality while not fully mitigating use-after-free conditions that may trigger during HTML/CSS processing. Prioritize iOS/iPadOS updates for high-value individuals given confirmed exploitation on mobile platforms. Organizations should verify update deployment through mobile device management systems and treat this as an emergency patch cycle given active exploitation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability stems from a use-after-free condition (CWE-416) in WebKit, Apple's browser engine that powers Safari and in-app web content rendering across the entire Apple ecosystem. Use-after-free vulnerabilities occur when code continues to use a memory pointer after the referenced memory has been deallocated, creating opportunities for attackers to manipulate freed memory regions and redirect program execution flow. In WebKit's case, processing specially crafted web content triggers premature deallocation of objects that are subsequently referenced during rendering or JavaScript execution. The cross-platform nature of WebKit means this single memory management flaw propagates across Safari on macOS, mobile Safari on iOS/iPadOS, and embedded WebKit instances in tvOS, watchOS, and visionOS applications. Apple's acknowledgment of exploitation specifically on iOS versions before iOS 26 indicates the vulnerability likely resided in WebKit's mobile implementation for an extended period before discovery.

Know when Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Apr 06, 2026 - 08:30 nvd
Patch available
Added to CISA KEV
Apr 03, 2026 - 14:17 cisa
CISA KEV
CVE Published
Dec 17, 2025 - 21:16 nvd
HIGH 8.8

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Executive ViewAI

Why It Matters

CVE-2025-43529 is a critical WebKit memory corruption vulnerability in Safari and Apple's operating systems (iOS, macOS, tvOS, visionOS, watchOS) that enables remote code execution when users visit malicious websites. With confirmed active exploitation by sophisticated threat actors targeting specific individuals and no patch currently available, this represents an immediate risk to organizations with Apple device fleets, particularly those with iOS deployments prior to version 26.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Safari access via Mobile Device Management (MDM) to whitelisted domains only; (2) Deploy network segmentation to limit lateral movement if device compromise occurs; (3) Disable JavaScript in Safari or enforce use of alternative browsers (Chrome, Firefox) where business requirements permit; (4) Increase endpoint detection and response (EDR) monitoring for unusual process execution on Apple devices; (5) Enforce mandatory OS updates to iOS 26+ where compatible; (6) Isolate or air-gap mission-critical iOS devices prior to iOS 26 until patch is released.

Threat Intelligence Overview

EPSS Score
0.1%
Top 68% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org CISA KEV EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

94
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

More in Ipados

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
CVE-2023-41974 HIGH POC
7.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2022-37434 CRITICAL POC
9.8 Aug 05

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
CVE-2022-48618 HIGH
7.0 Jan 09

The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.2 Container suse/sl-micro/6.1/base-os-container:2.2.0-4.55 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:23663 ADVISORY https://access.redhat.com/errata/RHSA-2025:23700 ADVISORY https://access.redhat.com/errata/RHSA-2025:23967 ADVISORY https://access.redhat.com/errata/RHSA-2025:23968 ADVISORY https://access.redhat.com/errata/RHSA-2025:23969 ADVISORY https://access.redhat.com/errata/RHSA-2025:23970 ADVISORY https://access.redhat.com/errata/RHSA-2025:23971 ADVISORY https://access.redhat.com/errata/RHSA-2025:23972 ADVISORY https://access.redhat.com/errata/RHSA-2025:23973 ADVISORY https://access.redhat.com/errata/RHSA-2025:23974 ADVISORY https://access.redhat.com/errata/RHSA-2025:23975 ADVISORY https://support.apple.com/en-us/125884 ADVISORY https://support.apple.com/en-us/125885 ADVISORY https://support.apple.com/en-us/125886 ADVISORY https://support.apple.com/en-us/125889 ADVISORY https://support.apple.com/en-us/125890 ADVISORY https://support.apple.com/en-us/125891 ADVISORY https://support.apple.com/en-us/125892 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4527/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4528/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20102/ REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy