CVE entry · CVE-2025-43529
CVE-2025-43529: Apple Multiple Products Use-After-Free WebKit Vulnerability
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
- Actively exploited: added to CISA’s KEV catalog on December 15, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: January 5, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes affected Apple products, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- Vendor advisory or reference cited by CISA (support.apple.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Apple vulnerabilities
-
Apple Multiple Products Out-of-Bounds Write Vulnerability
-
Apple macOS Improper Authentication Vulnerability
-
Apple Multiple Products Classic Buffer Overflow Vulnerability
-
Apple Multiple Products Improper Locking Vulnerability
-
Apple Multiple Products Buffer Overflow Vulnerability
-
Apple Multiple products Use-After-Free Vulnerability