CVE-2025-43213 - Vulnerability Details

- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Published: 2025-07-29

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Processing maliciously crafted web content can trigger a memory handling failure that results in Safari crashing. The available CWEs (CWE‑119 and CWE‑120) indicate that the flaw involves an out‑of‑bounds read or write. Because the crash eliminates the affected browser instance, the impact is a loss of availability but does not lead to data compromise or code execution.

Affected Systems

Apple Safari and the underlying WebKit engine on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The vulnerability is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6.

Risk and Exploitability

The CVSS score of 6.5 denotes a moderate severity. The EPSS score of less than 1 % indicates that public exploitation is currently low likelihood, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vector is the delivery of specifically crafted web content to a vulnerable Safari instance—such as a malicious website or a phishing email that loads the content—without any special privileges required. Users who visit these pages or open such emails risk forced crashes that may interrupt browsing or degrade service reliability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.6

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 2.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 11.6

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor	Product	Confidence	Versions
Apple	Ios	—	—
Apple	Ipados	—	—
Apple	Macos	—	—
Apple	Macos Sequoia	—	—
Apple	Tvos	—	—
Apple	Visionos	—	—
Apple	Watchos	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Safari to 18.6 or later, and update iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to the corresponding patched releases (18.6, 15.6, 18.6, 2.6, 11.6).
Enable automatic OS updates on all Apple devices so that the WebKit fix is applied as soon as it becomes available.
Monitor Safari crash logs for unexpected termination; if crashes continue after updating, verify the operating system level and, if necessary, contact Apple support via the provided links.

Generated by OpenCVE AI on April 28, 2026 at 11:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-23095	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Ubuntu USN	USN-8237-1	WebKitGTK vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00183.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Aug/0
http://seclists.org/fulldisclosure/2025/Jul/30
http://seclists.org/fulldisclosure/2025/Jul/32
http://seclists.org/fulldisclosure/2025/Jul/36
https://nvd.nist.gov/vuln/detail/CVE-2025-43213
https://support.apple.com/en-us/124147
https://support.apple.com/en-us/124149
https://support.apple.com/en-us/124152
https://support.apple.com/en-us/124153
https://support.apple.com/en-us/124154
https://support.apple.com/en-us/124155
https://webkitgtk.org/security/WSA-2026-0001.html
https://www.cve.org/CVERecord?id=CVE-2025-43213

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Fri, 20 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2025-43213 https://webkitgtk.org/security/WSA-2026-0001.html https://www.cve.org/CVERecord?id=CVE-2025-43213
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 03 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Aug/0 http://seclists.org/fulldisclosure/2025/Jul/30 http://seclists.org/fulldisclosure/2025/Jul/32 http://seclists.org/fulldisclosure/2025/Jul/36

Thu, 31 Jul 2025 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple iphone Os Apple safari
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple iphone Os Apple safari

Thu, 31 Jul 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Jul 2025 23:00:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/124152

Wed, 30 Jul 2025 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Apple ipados Apple macos Apple macos Sequoia Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios Apple ipados Apple macos Apple macos Sequoia Apple tvos Apple visionos Apple watchos

Wed, 30 Jul 2025 00:15:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.	The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Tue, 29 Jul 2025 23:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/124147 https://support.apple.com/en-us/124149 https://support.apple.com/en-us/124153 https://support.apple.com/en-us/124154 https://support.apple.com/en-us/124155

Subscriptions

Apple Ios Ipados Iphone Os Macos Macos Sequoia Safari Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-07-29T23:29:10.637Z

Updated: 2026-04-02T18:12:37.917Z

Reserved: 2025-04-16T15:24:37.089Z

Link: CVE-2025-43213

Vulnrichment

Updated: 2025-11-03T20:00:36.856Z

NVD

Status : Modified

Published: 2025-07-30T00:15:33.393

Modified: 2026-04-02T19:20:06.163

Link: CVE-2025-43213

Redhat

Severity : Important

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2025-43213 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T11:15:26Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object