Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
Published: 2025-12-17
Score: 8.8 High
EPSS: 25.7% Moderate
KEV: Yes
Impact: Arbitrary code execution via processed malicious web content
Action: Immediate Patch
AI Analysis

Impact

A use-after-free flaw in WebKitGTK’s memory handling causes attackers to trigger arbitrary code execution when a target processes specially crafted web content. The vulnerability stems from improper deallocation, classified under CWE-416 and related to CWE-825 because the freed memory can be accessed again, leading to code execution at the attacker’s choice. An attacker may load malicious input in a browser or web-view component to gain full control of the affected process.

Affected Systems

Apple’s Safari browser, and Apple operating systems iOS, iPadOS, macOS, tvOS, visionOS, watchOS are impacted. The vulnerability is fixed in Safari 26.2; iOS 18.7.3 and iPadOS 18.7.3; iOS 26.2 and iPadOS 26.2; macOS Tahoe 26.2; tvOS 26.2; visionOS 26.2; watchOS 26.2. Devices running earlier versions remain vulnerable.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity, and the EPSS score indicates a moderate exploit probability of 26%. However, the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that it has been leveraged in a highly targeted, sophisticated attack. Based on the description, it is inferred that the likely attack vector involves delivering malicious web content via an in-browser or web-view context, making the flaw exploitable in routine browsing or within malicious web applications.

Generated by OpenCVE AI on October 25, 2026 at 22:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Safari to version 26.2 or later and install all corresponding operating system updates for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that include the WebKitGTK patch.
  • For environments where an immediate OS or browser upgrade is not possible, block access to untrusted web content or configure enterprise content filters to restrict the loading of suspicious web pages.
  • If you control applications that embed WebKitGTK, ensure they bundle the latest patched WebKit version and apply vendor‑issued security updates promptly.

Generated by OpenCVE AI on October 25, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4414-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6083-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-7957-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Thu, 18 Dec 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Thu, 18 Dec 2025 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple macos
Apple macos Tahoe
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple macos
Apple macos Tahoe
Apple safari
Apple tvos
Apple visionos
Apple watchos

Thu, 18 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: webkitgtk: Use-after-free due to improper memory management
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 17 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 17 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
References
Metrics kev

{'dateAdded': '2025-12-15T00:00:00+00:00', 'dueDate': '2026-01-05T00:00:00+00:00'}

Subscriptions

Apple Ios Ipados Iphone Os Macos Macos Tahoe Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-21T16:46:54.698Z

Reserved: 2025-04-16T15:27:21.197Z

Link: CVE-2025-43529

cve-icon Vulnrichment

Updated: 2025-12-17T21:05:42.168Z

cve-icon NVD

Status : Analyzed

Published: 2025-12-17T21:16:11.570

Modified: 2026-10-07T11:10:00.153

Link: CVE-2025-43529

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-16T00:00:00Z

Links: CVE-2025-43529 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T22:15:14Z

Weaknesses