Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2025-12-17
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The flaw is a use‑after‑free bug in WebKitGTK that can be triggered by malicious web content. When triggered, the renderer process crashes, resulting in a denial of service to the user. The vulnerability does not allow code execution or data compromise, limiting its impact to service interruption.

Affected Systems

Apple Safari, iOS, iPadOS, and macOS are affected. Vulnerable releases include Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, the iOS 26.2 and iPadOS 26.2 releases, and macOS Tahoe 26.2. Devices running earlier versions remain exposed.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to deliver crafted web content—most likely through remote web pages or local files—to trigger the crash. The attack vector is inferred to be remote or local content delivery, but no privilege escalation or data exfiltration is possible.

Generated by OpenCVE AI on April 22, 2026 at 20:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Safari 26.2 or newer.
  • Apply the iOS 18.7.3 and iPadOS 18.7.3 updates.
  • Install macOS Tahoe 26.2 or later updates.
  • Avoid loading or visiting untrusted web content until you have applied the recommended updates.

Generated by OpenCVE AI on April 22, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4414-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6083-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-7957-1 WebKitGTK vulnerabilities
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Tahoe 26.2, iOS 26.2 and iPadOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3. Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Thu, 18 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Thu, 18 Dec 2025 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple macos
Apple macos Tahoe
Apple safari
Vendors & Products Apple
Apple ios
Apple ipados
Apple macos
Apple macos Tahoe
Apple safari

Thu, 18 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 17 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Tahoe 26.2, iOS 26.2 and iPadOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios Ipados Iphone Os Macos Macos Tahoe Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:12:18.179Z

Reserved: 2025-04-16T15:27:21.198Z

Link: CVE-2025-43536

cve-icon Vulnrichment

Updated: 2025-12-17T21:09:45.632Z

cve-icon NVD

Status : Modified

Published: 2025-12-17T21:16:12.260

Modified: 2026-04-02T19:21:01.300

Link: CVE-2025-43536

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-17T00:00:00Z

Links: CVE-2025-43536 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T20:30:26Z

Weaknesses