CVE-2025-43529

VendorappleProductmacos, iphone os, tvos, watchos, safari, ipados, visionosDiscoveredDec 17, 2025UpdatedOct 7, 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

View graph Watch Export

CVSS v3.1

8.8 HIGH

EPSS

25.7%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 26, 2026

▲ 16.8pp

8.89% → 25.7% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Connections

12 relationships

CWE-416

source

Timeline

disclosure → media coverage

Dec 13, 2025

acn.gov.it reports: Apple: rilevato sfruttamento attivo di vulnerabilità in WebKit

Dec 15, 2025

helpnetsecurity.com reports: Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529)

Dec 17, 2025

Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026

Sep 29, 2026

bleepingcomputer.com reports: Apple patches CoreGraphics zero-day flaw exploited in attacks

Public PoC (7)

github.com/jir4vv1t/CVE-2025-43529 github.com/0xjohnnydev/WebKit-UAF-ANGLE-OOB-Analysis github.com/SimoesCTT/Convergent-Time-Theory-Enhanced-iOS-Safari-RCE-CVE-2025-43529-github.com/SimoesCTT/CTT-Apple-Silicon-Refraction github.com/bjrjk/CVE-2025-43529 github.com/kmeps4/bugtest github.com/GenericCoding/pois0nSword

Unverified third-party code — review before executing.