CVE-2025-43536

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Tahoe 26.2, iOS 26.2 and iPadOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3. Processing maliciously crafted web content may lead to an unexpected process crash.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
appleCNA
---
---
CISA-ADPADP
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
applesafari
𝑥
< 26.2
appleipados
𝑥
< 18.7.3
appleipados
26.0 ≤
𝑥
< 26.2
appleiphone_os
𝑥
< 18.7.3
appleiphone_os
26.0 ≤
𝑥
< 26.2
applemacos
𝑥
< 26.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
webkit2gtk
bullseye
vulnerable
trixie
ignored
bookworm
ignored
bullseye (security)
2.50.4-1~deb11u1
fixed
bookworm (security)
2.50.4-1~deb12u1
fixed
trixie (security)
2.50.4-1~deb13u1
fixed
forky
2.50.4-1
fixed
sid
2.50.4-1
fixed
wpewebkit
bullseye (security)
vulnerable
bullseye
vulnerable
trixie
ignored
bookworm
ignored
forky
2.50.4-1
fixed
sid
2.50.4-1
fixed
Vulnerability Media Exposure