Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Published: 2025-07-29
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Immediate Patch
AI Analysis

Impact

A flaw in WebKitGTK's processing of maliciously crafted web content can corrupt memory during rendering. The memory corruption could destabilize the browser or any process using WebKitGTK and may enable attackers to execute arbitrary code or crash applications. The associated weakness is a classic buffer overflow (CWE‑119).

Affected Systems

The vulnerability affects Apple's Safari browser on macOS, tvOS, watchOS, visionOS, iOS, and iPadOS. Patching versions are Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Devices running earlier releases of these OSes or Safari are potentially impacted.

Risk and Exploitability

The CVSS base score of 8.8 marks this as a high‑severity issue. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and it is not currently listed in CISA's KEV catalog. Attackers would need to deliver malicious web content that is rendered by WebKitGTK, so user interaction with a compromised site is likely required. If triggered, the memory corruption can be used to escape sandbox boundaries or crash the affected application.

Generated by OpenCVE AI on April 28, 2026 at 00:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install or upgrade to the patched Safari, iOS, iPadOS, macOS, tvOS, visionOS, or watchOS versions (Safari 18.6, iOS 18.6 or iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6).
  • Ensure all other Apple devices run the latest supported OS updates that include the WebKitGTK fix.
  • Implement network or browser-based controls to block or sandbox malicious web content until patches are applied.

Generated by OpenCVE AI on April 28, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4276-1 webkit2gtk security update
Debian DSA Debian DSA DSA-5978-1 webkit2gtk security update
EUVD EUVD EUVD-2025-23105 The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.
Ubuntu USN Ubuntu USN USN-7702-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption. The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Tue, 05 Aug 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to memory corruption
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 31 Jul 2025 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os
Apple safari

Thu, 31 Jul 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Jul 2025 23:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption. The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.
References

Wed, 30 Jul 2025 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple macos
Apple macos Sequoia
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple macos
Apple macos Sequoia
Apple tvos
Apple visionos
Apple watchos

Wed, 30 Jul 2025 00:15:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption. The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.

Tue, 29 Jul 2025 23:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.
References

Subscriptions

Apple Ios Ipados Iphone Os Macos Macos Sequoia Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:09:24.679Z

Reserved: 2025-03-27T16:13:58.344Z

Link: CVE-2025-31278

cve-icon Vulnrichment

Updated: 2025-11-04T21:10:04.731Z

cve-icon NVD

Status : Modified

Published: 2025-07-30T00:15:30.950

Modified: 2026-04-02T19:19:59.860

Link: CVE-2025-31278

cve-icon Redhat

Severity : Important

Publid Date: 2025-08-01T00:00:00Z

Links: CVE-2025-31278 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T01:00:10Z

Weaknesses