PT-2025-54488 · Apple · Visionos+6

Published 2025-12-12 · Updated 2026-02-06 · CVE-2025-46298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apple Safari versions 26.2 Apple tvOS versions 26.2 Apple watchOS versions 26.2 Apple visionOS versions 26.2 Apple iOS versions 26.2 Apple iPadOS versions 26.2 macOS Tahoe versions 26.2

Description A type confusion issue exists in the JavaScriptCore FTL New Array Materialization component. Processing specially crafted web content may cause an unexpected process crash. The issue was addressed with improved memory handling.

Recommendations Update Apple Safari to version 26.2. Update Apple tvOS to version 26.2. Update Apple watchOS to version 26.2. Update Apple visionOS to version 26.2. Update Apple iOS to version 26.2. Update Apple iPadOS to version 26.2. Update macOS Tahoe to version 26.2.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2025-46298

ZDI-26-057

Affected Products

Apple Macos

Safari

Ios

Ipados

Tvos

Visionos

Watchos

References · 15

• https://osv.dev/vulnerability/CVE-2025-46298 · Vendor Advisory
• https://support.apple.com/en-us/125886 · Vendor Advisory
• https://support.apple.com/en-us/125892 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-057 · Security Note
• https://support.apple.com/en-us/125890 · Vendor Advisory
• https://support.apple.com/en-us/125889 · Vendor Advisory
• https://support.apple.com/en-us/125891 · Vendor Advisory
• https://support.apple.com/en-us/125884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46298 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46298 · Note
• https://twitter.com/VulmonFeeds/status/2009843679251279963 · Twitter Post
• https://twitter.com/CVEnew/status/2009741108692091203 · Twitter Post
• https://t.me/CVEtracker/41881 · Telegram Post
• https://twitter.com/hosselot/status/2019794419646427190 · Twitter Post
• https://twitter.com/vuldb/status/2009746779458113803 · Twitter Post