Description
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-05-12
Score: 6.5 Medium
EPSS: 1.1% Low
KEV: No
Impact: Denial of Service
Action: Apply Update
AI Analysis

Impact

Processing maliciously crafted web content may lead to an unexpected process crash due to improper input validation (CWE-20) and null pointer dereference (CWE-476). If an attacker can supply the crafted content, the affected process will terminate, potentially causing unavailability of the web application or browser and disrupting user experience.

Affected Systems

Apple products including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The fix is applied in Safari 18.5, iOS 18.5, iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5. Red Hat Enterprise Linux 8 and 9 families may also be impacted through WebKitGTK updates.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of 1% shows a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page that renders content in a WebKitGTK-enabled application, which an attacker can use to cause a crash.

Generated by OpenCVE AI on April 28, 2026 at 02:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Apple operating systems to Safari 18.5, iOS 18.5, iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, or watchOS 11.5 or later.
  • Apply the latest Red Hat Enterprise Linux security updates that include the WebKitGTK patch for affected RHEL 8 and 9 releases.
  • Configure your web environment to avoid loading untrusted content in WebKitGTK instances, or use sandboxing mechanisms where available to limit crash impact.

Generated by OpenCVE AI on April 28, 2026 at 02:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4218-1 webkit2gtk security update
Debian DSA Debian DSA DSA-5937-1 webkit2gtk security update
EUVD EUVD EUVD-2025-14780 The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash.
Ubuntu USN Ubuntu USN USN-7566-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 07 Jul 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Wed, 28 May 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos

Fri, 16 May 2025 02:30:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
Weaknesses CWE-476
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 May 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 May 2025 21:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ipados Iphone Os Macos Safari Tvos Visionos Watchos
Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:08:38.906Z

Reserved: 2025-03-27T16:13:58.317Z

Link: CVE-2025-31215

cve-icon Vulnrichment

Updated: 2025-11-03T19:49:29.318Z

cve-icon NVD

Status : Modified

Published: 2025-05-12T22:15:22.433

Modified: 2026-04-02T19:19:48.967

Link: CVE-2025-31215

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-05-15T00:00:00Z

Links: CVE-2025-31215 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T02:00:15Z

Weaknesses