PT-2025-51037 · Apple +7 · Ipados +14

Published 2025-12-12 · Updated 2026-01-22 · CVE-2025-43529

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKitGTK versions 2.50.4-0ubuntu0.25.04.1 Apple iOS versions prior to 18.7.3 Apple iPadOS versions prior to 18.7.3 Apple macOS versions prior to 26.2 Apple tvOS versions prior to 26.2 Apple watchOS versions prior to 26.2 Apple visionOS versions prior to 26.2 Safari versions prior to 26.2

Description Multiple security issues were discovered in the WebKitGTK Web and JavaScript engines and in Apple’s WebKit component. These issues include use-after-free vulnerabilities that could allow a remote attacker to execute arbitrary code, trigger crashes, or bypass security restrictions. Exploitation may occur when a user views a malicious website. The vulnerability in Apple’s WebKit is actively exploited in the wild and has been identified as CVE-2025-43529. The vulnerability stems from improper memory management in WebKit’s HTML parsing logic. The vulnerability affects multiple Apple operating systems and products that rely on WebKit for HTML rendering. Reports indicate that this issue may have been exploited in sophisticated attacks targeting specific individuals.

Recommendations Update WebKitGTK to version 2.50.4-0ubuntu0.25.04.1. Update Apple iOS to version 18.7.3 or later. Update Apple iPadOS to version 18.7.3 or later. Update Apple macOS to version 26.2 or later. Update Apple tvOS to version 26.2 or later. Update Apple watchOS to version 26.2 or later. Update Apple visionOS to version 26.2 or later. Update Safari to version 26.2 or later.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-00005

CVE-2025-43529

DLA-4414-1

DSA-6083-1

USN-7957-1

Affected Products

Almalinux

Centos

Debian

Linuxmint

Apple Macos

Red Hat

Rocky Linux

Safari

Ubuntu

Webkit

Ios

Ipados

Tvos

Visionos

Watchos

References · 107

• https://cve.org/CVERecord?id=CVE-2025-43529 · Security Note
• https://ubuntu.com/security/CVE-2025-43501 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43541 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7957-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14174 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43536 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00005 · Security Note
• https://support.apple.com/en-us/125886 · Security Note, Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43529 · Security Note
• https://support.apple.com/en-us/125890 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43529 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7957-1 · Vendor Advisory
• https://support.apple.com/en-us/125884 · Security Note, Vendor Advisory
• https://support.apple.com/en-us/125892 · Security Note, Vendor Advisory
• https://support.apple.com/en-us/125891 · Vendor Advisory