Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2025-09-15
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Application Crash (Denial of Service)
Action: Apply Patch
AI Analysis

Impact

The flaw is a memory handling error (CWE-119) that can be triggered when WebKitGTK processes maliciously crafted web content. This results in a deterministic crash of Safari and the system’s WebKit-based applications, causing a denial‑of‑service condition for the user session but not enabling code execution or data exfiltration.

Affected Systems

Affecting Apple’s Safari browser and the underlying WebKit engine across all major Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability is resolved in Safari 26, iOS 26, iPadOS 26, macOS Tahoe 26, visionOS 26, and watchOS 26, as documented by Apple’s update support pages.

Risk and Exploitability

With a CVSS score of 6.5 it is considered moderate severity, while an EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector involves a maliciously crafted webpage or data stream delivered to the user’s browser; the attacker needs only to supply the bad content and does not require elevated privileges.

Generated by OpenCVE AI on April 28, 2026 at 00:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Apple security updates that include Safari 26, iOS 26, iPadOS 26, macOS Tahoe 26, visionOS 26, and watchOS 26 to fix the memory handling issue.
  • Update the WebKitGTK library used by your applications to the latest version that incorporates the same memory‑handling fix.
  • Until the updates are applied, restrict browsing to trusted sites or disable external content features to reduce the risk of triggering the crash.

Generated by OpenCVE AI on April 28, 2026 at 00:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4375-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6042-1 webkit2gtk security update
EUVD EUVD EUVD-2025-29323 The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Ubuntu USN Ubuntu USN USN-7817-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in visionOS 26, Safari 26, iOS 26 and iPadOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Tue, 04 Nov 2025 02:30:00 +0000

Type Values Removed Values Added
References

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue was addressed with improved memory handling. This issue is fixed in visionOS 26, Safari 26, iOS 26 and iPadOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 24 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 17 Sep 2025 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple macos
Apple safari
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple macos
Apple safari
Apple visionos
Apple watchos

Tue, 16 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Sep 2025 22:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Macos Safari Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:14:42.586Z

Reserved: 2025-04-16T15:24:37.100Z

Link: CVE-2025-43272

cve-icon Vulnrichment

Updated: 2025-11-04T21:10:38.812Z

cve-icon NVD

Status : Modified

Published: 2025-09-15T23:15:31.240

Modified: 2026-04-02T19:20:18.117

Link: CVE-2025-43272

cve-icon Redhat

Severity : Important

Publid Date: 2025-09-23T00:00:00Z

Links: CVE-2025-43272 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T00:15:05Z

Weaknesses