Apple iOS/iPadOS/macOS/tvOS/Safari up to 26.1 WebKit use after free

Summaryinfo

A vulnerability labeled as critical has been found in Apple iOS, iPadOS, macOS, tvOS and Safari up to 26.1. This impacts an unknown function of the component WebKit. The manipulation results in use after free. This vulnerability is cataloged as CVE-2025-43529. The attack may be launched remotely. Furthermore, there is an exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS and Safari up to 26.1. It has been classified as critical. Affected is an unknown part of the component WebKit. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

The advisory is shared for download at support.apple.com. This vulnerability is traded as CVE-2025-43529. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $25k-$100k (estimation calculated on 03/19/2026).

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 279013 (Linux Distros Unpatched Vulnerability : CVE-2025-43529), which helps to determine the existence of the flaw in a target environment. This issue was added on 12/15/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 01/05/2026:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 26.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (1058), Tenable (279013) and CERT Bund (WID-SEC-2025-2838). Once again VulDB remains the best source for vulnerability data.

Affected

• Apple macOS

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS
• iPadOS
• macOS
• Safari
• tvOS

Version

• 26.0
• 26.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion