Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-11-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (process crash)
Action: Monitor
AI Analysis

Impact

A flaw in WebKitGTK’s state management allows maliciously crafted web content to trigger an unexpected process crash. The resulting denial of service can suspend the browsing process, disrupting user interactions without compromising system integrity or confidentiality.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The vulnerability exists in versions up to Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1.

Risk and Exploitability

The CVSS score is 4.3, reflecting a moderate impact. The EPSS value is below 1 %, indicating a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The attack vector appears to be remote via malicious web content delivered to the user; no local privilege escalation or data theft is described.

Generated by OpenCVE AI on April 22, 2026 at 21:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Safari and all Apple operating systems to at least the version that contains the WebKitGTK fix—Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, or watchOS 26.1 or later.
  • After installing the updates, reboot the device to ensure the updated WebKit binaries are active.
  • If immediate patching cannot be performed, isolate the device from untrusted web traffic by applying network-level filtering or a proxy that blocks sites known to deliver malicious content, and consider disabling or restricting WebKit-based browsing until the fix is applied.

Generated by OpenCVE AI on April 22, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4399-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6074-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-7941-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed through improved state management. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Fri, 05 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-119
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 05 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Nov 2025 18:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Wed, 05 Nov 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-703
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:14:45.627Z

Reserved: 2025-04-16T15:24:37.125Z

Link: CVE-2025-43458

cve-icon Vulnrichment

Updated: 2025-11-04T19:08:21.536Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:51.213

Modified: 2026-04-02T19:20:49.753

Link: CVE-2025-43458

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-04T00:00:00Z

Links: CVE-2025-43458 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T21:45:06Z

Weaknesses