CVE-2025-43431 - Vulnerability Details

- webkitgtk: Processing maliciously crafted web content may lead to memory corruption

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.

Published: 2025-11-04

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability occurs when WebKitGTK processes maliciously crafted web content and fails to enforce proper bounds checking on memory structures. The resulting memory corruption allows an attacker to overwrite arbitrary memory, potentially leading to execution of attacker code, data modification, or denial of service. The weakness corresponds to CWE‑119, CWE‑120 and CWE‑787.

Affected Systems

Apple products that incorporate WebKitGTK, specifically Safari, as well as the web engines in iOS, iPadOS, macOS, tvOS, visionOS and watchOS, are impacted. The affected firmware versions are Safari 26.1, iOS 18.7.2 and iOS 26.1, iPadOS 18.7.2 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1 and watchOS 26.1. Systems running any of these releases are susceptible when rendering web pages that contain malicious code.

Risk and Exploitability

The CVSS score of 8.8 flags a high severity vulnerability, while the EPSS score of less than 1 % indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to deliver crafted web content to a user’s browser, thus the primary launch vector is the rendering of malicious web pages. Successful exploitation could corrupt memory sufficient to gain arbitrary code execution or cause a crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.1

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.2
`0`	affected	< 26.1

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.1

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.1

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.1

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.1

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor	Product	Confidence	Versions
Apple	Ios	—	—
Apple	Ipados	—	—
Apple	Safari	—	—
Apple	Tvos	—	—
Apple	Visionos	—	—
Apple	Watchos	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Install the latest security updates for Safari (26.1 or newer) and all affected Apple operating systems as listed above.
Update every device to the fixed releases: iOS 18.7.2 or 26.1, iPadOS 18.7.2 or 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1, using the standard Software Update mechanism or a device‑management solution.
If a timely update is unavailable, isolate the device by disabling or removing WebKit-based browsers or block exposure to untrusted web content through network segmentation or content filtering as a temporary mitigation.

Generated by OpenCVE AI on April 22, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4394-1	webkit2gtk security update
Debian DSA	DSA-6070-1	webkit2gtk security update
Ubuntu USN	USN-7914-1	WebKitGTK vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00066.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-43431
https://support.apple.com/en-us/125632
https://support.apple.com/en-us/125633
https://support.apple.com/en-us/125634
https://support.apple.com/en-us/125637
https://support.apple.com/en-us/125638
https://support.apple.com/en-us/125639
https://support.apple.com/en-us/125640
https://webkitgtk.org/security/WSA-2025-0008.html
https://www.cve.org/CVERecord?id=CVE-2025-43431

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.

Wed, 17 Dec 2025 21:00:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to memory corruption.
References		https://support.apple.com/en-us/125632 https://support.apple.com/en-us/125634 https://support.apple.com/en-us/125637 https://support.apple.com/en-us/125638 https://support.apple.com/en-us/125639 https://support.apple.com/en-us/125640

Mon, 01 Dec 2025 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 22 Nov 2025 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to memory corruption
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2025-43431 https://webkitgtk.org/security/WSA-2025-0008.html https://www.cve.org/CVERecord?id=CVE-2025-43431
Metrics	threat_severity `None`	threat_severity `Important`

Wed, 05 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
References	https://support.apple.com/en-us/125632 https://support.apple.com/en-us/125637 https://support.apple.com/en-us/125638 https://support.apple.com/en-us/125639 https://support.apple.com/en-us/125640

Wed, 05 Nov 2025 18:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to memory corruption.
References		https://support.apple.com/en-us/125633

Wed, 05 Nov 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple iphone Os
Weaknesses		CWE-787
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple iphone Os

Tue, 04 Nov 2025 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Apple ipados Apple safari Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios Apple ipados Apple safari Apple tvos Apple visionos Apple watchos

Tue, 04 Nov 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 04 Nov 2025 01:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to memory corruption.
References		https://support.apple.com/en-us/125632 https://support.apple.com/en-us/125637 https://support.apple.com/en-us/125638 https://support.apple.com/en-us/125639 https://support.apple.com/en-us/125640

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-11-04T01:17:31.690Z

Updated: 2026-04-02T18:23:24.836Z

Reserved: 2025-04-16T15:24:37.124Z

Link: CVE-2025-43431

Vulnrichment

Updated: 2025-11-04T13:04:41.170Z

NVD

Status : Modified

Published: 2025-11-04T02:15:48.950

Modified: 2026-04-02T19:20:45.537

Link: CVE-2025-43431

Redhat

Severity : Important

Publid Date: 2025-11-20T00:00:00Z

Links: CVE-2025-43431 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-22T21:30:27Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object