CVE-2025-43529
Attackers can run malicious code on Apple devices by exploiting a use-after-free memory flaw.
A use-after-free bug in Apple's WebKit engine lets attackers execute arbitrary code when a user processes malicious web content. It affects multiple Apple products including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw is actively exploited by attackers, and Apple has released fixes.
Apple Safari · Updated 4 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 15 Dec; US agencies must fix by 5 Jan
SeverityhighCVSS 8.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Safari 26.2 | 26.2 |
| iOS and iPadOS 26.2 | 26.2 |
| macOS 26.2 | 26.2 |
| tvOS 26.2 | 26.2 |
What to do
- Install the fixed versions: Safari 26.2, iOS 18.7.3, iPadOS 18.7.3, iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.
- Update all affected Apple devices as soon as possible to prevent exploitation.
- Avoid opening suspicious links or web content from untrusted sources.
- If you cannot update immediately, disable JavaScript in your browser as a workaround per Apple’s advice.
What happened
- 15 DecApple issued fixes for the flaw.
- 15 DecCISA added the flaw to its known-exploited list and required U.S. federal agencies to fix by 2026-01-05.
- 4 NovResearchers reported that Russian hackers used n-day exploits for this vulnerability in zero-click attacks on iOS and Android devices.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2025-43529 | Apple Multiple Products Use-After-Free WebKit Vulnerability | high 8.8 | 15 Dec | 26% |
Our reporting
4 NovRussian hackers deployed n-day exploits in zero-click attacks on iOS and Android devices, researchers sayReported elsewhere
BleepingComputer · 4 NovHackers use n-day exploits in zero-click attacks on iOS, Android devices ↗The records
CISA known-exploited catalog ↗CVE-2025-43529 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free