Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-11-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (process crash)
Action: Patch Update
AI Analysis

Impact

Improper state management in the WebKitGTK engine causes it to crash when processing specially crafted web content. This results in a denial of service, potentially disrupting user sessions and compromising the availability of browsers or web‑based applications. The weakness involves improper input validation (CWE‑20) and logical errors in state handling (CWE‑703).

Affected Systems

The bug affects Apple products, including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS on versions before 26.1. The issue is present in all current releases of these platforms that have not applied the 26.1 update, which incorporates the necessary state‑management fix.

Risk and Exploitability

The CVSS score of 4.3 indicates a low severity impact, and the EPSS score of <1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can provoke the crash by delivering malicious web content within a page that a user visits, leading to a local denial of service. The low exploitation likelihood reflects the lack of readily available exploit code and the requirement for the target to load the affected web content.

Generated by OpenCVE AI on April 22, 2026 at 21:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Safari 26.1, iOS 26.1, iPadOS 26.1, macOS 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1 to apply the WebKitGTK fix
  • Apply all available Apple system updates through the built‑in update mechanisms to ensure the latest WebKitGTK components are installed
  • If your environment uses a custom WebKitGTK build, upgrade that library to the 26.1 release or later

Generated by OpenCVE AI on April 22, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4394-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6070-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-7914-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed through improved state management. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Sat, 22 Nov 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 05 Nov 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-703

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 04 Nov 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:26:36.439Z

Reserved: 2025-04-16T15:24:37.124Z

Link: CVE-2025-43430

cve-icon Vulnrichment

Updated: 2025-11-04T12:56:04.549Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:48.850

Modified: 2026-04-02T19:20:45.350

Link: CVE-2025-43430

cve-icon Redhat

Severity : Important

Publid Date: 2025-11-20T00:00:00Z

Links: CVE-2025-43430 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T21:30:27Z

Weaknesses