CVE-2025-43531
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A race condition was addressed with improved state handling. Processing maliciously crafted web content may lead to an unexpected process crash.
Risk Assessment
Processing malicious content could cause the browser or system to crash, leading to service unavailability and potential data integrity issues.
Recommendation
Update Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to the latest patched versions.
Other vulnerabilities in Apple WebKit
See all- CVE-2023-41074High
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
- CVE-2023-32435HighActively exploited
A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
- CVE-2023-32409HighActively exploited
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2023-32373HighActively exploited
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2021-1789HighActively exploited
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
Original NVD description (English source)
A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS