CVE-2025-43342CWE-20

CVE-2025-43342

Critical · published September 16, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

🔥 A crafty piece of malicious web content can cause Safari and various Apple OS to crash unexpectedly! Think of it like a restaurant where one dish is so poorly prepared that it causes a kitchen shutdown – no more service until the mess is cleaned up! An attacker could exploit this flaw to serve harmful content, resulting in sudden crashes that disrupt your browsing experience and may lead to data loss. This is absolutely devastating as it affects not only your device's performance but also the reliability of your workflows.

Put simply

Think of it like a restaurant where one dish is so poorly prepared that it causes a kitchen shutdown – no more service until the mess is cleaned up! This vulnerability arises from insufficient checks when processing web content, allowing for crafted data to crash the application unexpectedly. It affects all Apple platforms, including Safari, iOS, and macOS variants, highlighting a critical oversight in error handling.

What to do

An attacker could exploit this flaw to serve harmful content, resulting in sudden crashes that disrupt your browsing experience and may lead to data loss. This is absolutely devastating as it affects not only your device's performance but also the reliability of your workflows. Update your devices immediately to the latest versions: Safari 26, iOS and iPadOS 18.7, and macOS Tahoe 26. Staying current is crucial, so enable automatic updates if you haven't already! You've got this! With these updates, you'll be back to browsing safely in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00747 · 54.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-09-16T03:15Z
Affected products (9)
ProductVersionsFixed in
apple/safari< 26.026.0
apple/ipados< 18.718.7
apple/iphone_os< 18.718.7
apple/macos< 26.026.0
apple/tvos< 26.026.0
apple/visionos< 26.026.0
apple/watchos< 26.026.0
webkitgtk/webkitgtk< 2.48.72.48.7
wpewebkit/wpe_webkit< 2.48.72.48.7
References (12)
EPSS history
Timeline
  • 15 SEP 22:35Z
    A correctness issue was addressed with improved checks
    cvelistv5