Description
A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unexpected process crash, potential denial of service
Action: Patch
AI Analysis

Impact

A correctness issue in the rendering engine can cause a process to crash when handling maliciously crafted web content. The flaw is identified as an input validation weakness (CWE-20). Because the crash stops the affected process, the main consequence is interruption of service rather than disclosure of sensitive data or code execution.

Affected Systems

The vulnerability affects Apple’s Safari web browser across multiple platforms including macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. The corrective updates are Safari 26 and equivalent OS releases such as iOS 18.7, 26, iPadOS 18.7, 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. Any older version remaining on user devices remains vulnerable.

Risk and Exploitability

The CVSS score of 9.8 reflects a severe impact. The EPSS score of less than 1% indicates that the likelihood of real-world exploitation is currently very low, and the flaw is not listed in the CISA KEV catalog. Attackers would exploit the weakness by delivering specially crafted web content to a user’s browser, causing a crash without needing to exploit memory corruption or privileges. The impact is limited to denial of service for the user of the affected process, but it can be leveraged to disrupt user experience or to serve as a precursor to more targeted attacks if combined with other vulnerabilities.

Generated by OpenCVE AI on April 28, 2026 at 10:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Apple software updates that include Safari 26 and the corresponding OS releases (iOS 18.7/26, iPadOS 18.7/26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26).
  • If immediate patching is not possible, avoid loading untrusted or unknown web content, and use browser settings that restrict third‑party content or lower security risks.
  • Enable Safari’s Safe Browsing protection or use a corporate proxy to filter malicious web content.

Generated by OpenCVE AI on April 28, 2026 at 10:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4375-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6042-1 webkit2gtk security update
EUVD EUVD EUVD-2025-29308 A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
Ubuntu USN Ubuntu USN USN-7817-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. Processing maliciously crafted web content may lead to an unexpected process crash. A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Thu, 20 Nov 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Webkitgtk
Webkitgtk webkitgtk
Wpewebkit
Wpewebkit wpe Webkit
CPEs cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*
Vendors & Products Webkitgtk
Webkitgtk webkitgtk
Wpewebkit
Wpewebkit wpe Webkit

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Tue, 04 Nov 2025 02:30:00 +0000

Type Values Removed Values Added
References

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected process crash. A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. Processing maliciously crafted web content may lead to an unexpected process crash.

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 24 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 17 Sep 2025 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 16 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 15 Sep 2025 22:45:00 +0000

Type Values Removed Values Added
Description A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Macos Safari Tvos Visionos Watchos
Webkitgtk Webkitgtk
Wpewebkit Wpe Webkit
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:18:35.046Z

Reserved: 2025-04-16T15:24:37.110Z

Link: CVE-2025-43342

cve-icon Vulnrichment

Updated: 2025-11-04T21:10:40.303Z

cve-icon NVD

Status : Modified

Published: 2025-09-15T23:15:36.483

Modified: 2026-04-02T19:20:30.237

Link: CVE-2025-43342

cve-icon Redhat

Severity : Important

Publid Date: 2025-09-23T00:00:00Z

Links: CVE-2025-43342 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T10:45:29Z

Weaknesses