Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to memory corruption.
Published: 2025-11-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Immediate Patch
AI Analysis

Impact

The flaw occurs when Apple’s WebKitGTK engine processes maliciously crafted web content, leading to memory corruption. The weakness is identified as CWE‑119, representing an improper handling of buffer boundaries. While the data does not provide a concrete exploitation example, the nature of the buffer overflow implies potential to execute code, thereby threatening confidentiality, integrity, and availability.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The vulnerability exists in all releases before version 26 of each product and has been corrected in Safari 26, iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26, and watchOS 26.

Risk and Exploitability

The CVSS score of 8.8 denotes a high severity. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. The attack vector can be inferred as remote via malicious web content, given the memory corruption in a browser engine.

Generated by OpenCVE AI on April 28, 2026 at 18:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Apple software updates (Safari 26, iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26, watchOS 26) to receive the WebKitGTK memory handling fix.
  • If upgrading is not immediately feasible, sandbox the affected browsers with minimal privileges and restrict parsing or execution of arbitrary web content.
  • Implement network segmentation and monitoring to detect potential exploitation attempts, and disable WebKitGTK in legacy applications when possible.

Generated by OpenCVE AI on April 28, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory corruption. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to memory corruption.
References

Sat, 22 Nov 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to memory corruption
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 05 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 04 Nov 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory corruption.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:14:31.286Z

Reserved: 2025-04-16T15:24:37.123Z

Link: CVE-2025-43419

cve-icon Vulnrichment

Updated: 2025-11-04T15:38:33.811Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:47.780

Modified: 2026-04-02T19:20:43.387

Link: CVE-2025-43419

cve-icon Redhat

Severity : Important

Publid Date: 2025-11-20T00:00:00Z

Links: CVE-2025-43419 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T18:45:15Z

Weaknesses