Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2025-11-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A use‑after‑free bug in WebKitGTK was identified in Safari and related Apple browsers. The flaw arises from insufficient memory cleanup after removal of a memory reference, causing a crash when the browser processes specially crafted web content. The primary outcome is a denial‑of‑service because the targeted browser terminates unexpectedly, disrupting user sessions and potentially leading to broader availability issues for services dependent on the browser.

Affected Systems

Affected vendors include Apple with the Safari web browser and the operating systems Apple iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability is fixed in Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1. Earlier releases before these versions remain susceptible.

Risk and Exploitability

The CVSS rating of 6.5 labels the bug as moderately severe, and an EPSS score of less than 1% indicates a very low exploitation probability. It is not listed in the CISA KEV catalog. The attack is most likely carried out remotely via malicious web content delivered over the network, making it exploitable by any compromised or malicious website visited by a user running one of the affected Apple platforms.

Generated by OpenCVE AI on April 28, 2026 at 10:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all Apple devices to Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1 or later to eliminate the vulnerability.
  • As an interim measure, restrict access to potentially malicious sites or enable browser security features such as content blockers until the patch is installed.
  • Continually check Apple’s security advisories and WebKitGTK release notes for additional updates that address this issue or related memory‑management problems.

Generated by OpenCVE AI on April 28, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4528-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6172-1 webkit2gtk security update
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Fri, 20 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Tue, 04 Nov 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple visionos
Apple watchos

Tue, 04 Nov 2025 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:22:21.957Z

Reserved: 2025-04-16T15:24:37.125Z

Link: CVE-2025-43457

cve-icon Vulnrichment

Updated: 2025-11-04T13:05:30.808Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:51.120

Modified: 2026-04-02T19:20:49.577

Link: CVE-2025-43457

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2025-43457 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T10:30:29Z

Weaknesses