PT-2025-51037 · Apple+7 · Ipados+14

Published

2025-12-12

·

Updated

2026-03-03

·

CVE-2025-43529

CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions WebKitGTK versions 2.50.4-0ubuntu0.25.04.1 Apple iOS, iPadOS, macOS, Safari, watchOS, and visionOS versions prior to updates addressing CVE-2025-43529 PS5 version 11.00 and earlier
Description The WebKitGTK Web and JavaScript engines, as well as Apple’s WebKit framework used in Safari and other applications, contain vulnerabilities. A use-after-free issue has been identified, allowing a remote attacker to potentially execute arbitrary code, trigger crashes, or bypass security restrictions. This vulnerability is actively exploited in the wild and has been assigned the identifier CVE-2025-43529. The root cause is a flaw in the JSC DFG JIT compiler, specifically related to memory management during escape analysis. Exploitation involves converting the use-after-free condition into a type confusion, structure mismatch, or arbitrary read/write primitive. The vulnerability affects multiple Apple platforms, including iOS, iPadOS, macOS, watchOS, visionOS, and tvOS. It has been confirmed on PS5 systems.
Recommendations Update WebKitGTK to version 2.50.4-0ubuntu0.25.04.1. Update Apple iOS, iPadOS, macOS, watchOS, visionOS, and tvOS to the latest available versions. For PS5 users, ensure the system is updated to the latest available firmware.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:23663
ALSA-2025:23700
BDU:2026-00005
CVE-2025-43529
DLA-4414-1
DSA-6083-1
SUSE-SU-2025:4527-1
SUSE-SU-2025:4528-1
USN-7957-1

Affected Products

Almalinux
Centos
Debian
Linuxmint
Apple Macos
Red Hat
Rocky Linux
Safari
Ubuntu
Webkit
Ios
Ipados
Tvos
Visionos
Watchos