Description
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-11-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Unexpected Process Crash
Action: Patch
AI Analysis

Impact

A buffer overflow was discovered in WebKitGTK due to insufficient bounds checking during the processing of maliciously crafted web content. Exploit of this flaw leads to an unexpected process crash, causing a denial of service for the affected browser or web view. The vulnerability is a classic buffer overrun (CWE‑119/CWE‑120) that does not provide an attacker with code execution or data disclosure, but it can reliably destabilize the user experience.

Affected Systems

The issue affects Apple products that use WebKitGTK components: Safari, iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw was fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. Devices running older versions are still vulnerable.

Risk and Exploitability

The CVSS score is 4.3, ranking the vulnerability as medium in severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is the delivery of specially crafted web content to a browser or application that relies on WebKitGTK; a successful exploit results in a process crash but does not provide remote code execution or privilege escalation.

Generated by OpenCVE AI on April 22, 2026 at 21:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Safari and the associated Apple software to at least the fixed versions specified above (Safari 26.1, iOS 18.7.2/iPadOS 18.7.2, iOS 26.1/iPadOS 26.1, macOS 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1).
  • If immediate updates are unavailable, restrict or remove access to untrusted web content that may be processed by WebKitGTK‑based components; consider disabling such content rendering in the affected applications.
  • Apply the Apple recommended sandboxing and safe browsing controls to isolate the browser processes from the rest of the system, reducing the impact of any crash on overall device stability.

Generated by OpenCVE AI on April 22, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4394-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6070-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-7914-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A buffer overflow was addressed with improved bounds checking. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash. A buffer overflow was addressed with improved bounds checking. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Sat, 22 Nov 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 05 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Nov 2025 18:45:00 +0000

Type Values Removed Values Added
Description A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Wed, 05 Nov 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 04 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:08:34.086Z

Reserved: 2025-04-16T15:24:37.124Z

Link: CVE-2025-43429

cve-icon Vulnrichment

Updated: 2025-11-04T14:43:28.451Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:48.727

Modified: 2026-04-02T19:20:45.163

Link: CVE-2025-43429

cve-icon Redhat

Severity : Important

Publid Date: 2025-11-20T00:00:00Z

Links: CVE-2025-43429 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T22:00:18Z

Weaknesses