CVE-2025-43211
BaseFortify
Publication date: 2025-07-30
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | safari | to 18.6 (exc) |
| apple | ipados | to 17.7.9 (exc) |
| apple | ipados | From 18.0 (inc) to 18.6 (exc) |
| apple | iphone_os | to 18.6 (exc) |
| apple | macos | to 15.6 (exc) |
| apple | tvos | to 18.6 (exc) |
| apple | visionos | to 2.6 (exc) |
| apple | watchos | to 11.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves processing maliciously crafted web content that leads to a denial-of-service condition by causing unexpected crashes due to improper memory handling. It is a use-after-free type of memory corruption issue in WebKit, which was mitigated by improved memory management in the affected Apple operating systems. [1]
How can this vulnerability impact me? :
This vulnerability can cause your device to unexpectedly crash or become unresponsive when processing certain web content, resulting in a denial-of-service. This impacts system stability and availability, potentially interrupting your use of affected Apple devices and services. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your Apple devices to the fixed versions: macOS Sequoia 15.6, iPadOS 17.7.9, iOS 18.6, iPadOS 18.6, tvOS 18.6, watchOS 11.6, or visionOS 2.6. These updates include improved memory handling that addresses the issue. Applying these security updates promptly will enhance system stability and security by preventing potential denial-of-service caused by processing malicious web content. [1]