CVE-2025-43529KEV · OVERDUECWE-416

Apple Multiple Products Use-After-Free WebKit Vulnerability

High · published December 18, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.2th percentile for exploit probability.

291
days past CISA
deadline
CVSS v3.1
8.8
EPSS
9%
Percentile
95.2
In the wild
Confirmed
What it is

🚨 A sneaky use-after-free vulnerability in Apple's software could let attackers execute code just like flipping a switch in your home! 🔥 Think of a use-after-free issue like a restaurant where the same table gets reserved for different customers at the same time — if one customer leaves, the staff might accidentally give their table to someone else unexpectedly, leading to chaos! An attacker could exploit this vulnerability to run arbitrary code on your device, which means they could potentially access sensitive data, install malicious software, or even take control of your device entirely. It's a serious risk, especially since Apple has acknowledged attempts to exploit it in targeted attacks against specific individuals!

Put simply

Think of a use-after-free issue like a restaurant where the same table gets reserved for different customers at the same time — if one customer leaves, the staff might accidentally give their table to someone else unexpectedly, leading to chaos! This use-after-free issue affects how memory is managed in Apple's operating systems, allowing maliciously crafted web content to manipulate memory and execute unauthorized commands. It's a classic case where mishandled memory leads to unexpected and disastrous consequences.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your device, which means they could potentially access sensitive data, install malicious software, or even take control of your device entirely. It's a serious risk, especially since Apple has acknowledged attempts to exploit it in targeted attacks against specific individuals! To protect yourself, update to Safari 26.2, iOS 18.7.3, iPadOS 18.7.3, or the latest versions of macOS, tvOS, visionOS, and watchOS immediately. Regularly checking for updates and enabling automatic updates can also help keep your devices secure. You've got this! Stay proactive, and you'll keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08763 · 95.2th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-18T02:16Z
KEV added
2025-12-15 · due 2026-01-05
Affected products (9)
ProductVersionsFixed in
apple/safari< 26.226.2
apple/ipados< 18.7.318.7.3
apple/ipados≥ 26.0, < 26.226.2
apple/iphone_os< 18.7.318.7.3
apple/iphone_os≥ 26.0, < 26.226.2
apple/macos≥ 26.0, < 26.226.2
apple/tvos< 26.226.2
apple/visionos< 26.226.2
apple/watchos< 26.226.2
References (8)
EPSS history
Timeline
  • 17 DEC 20:46Z
    A use-after-free issue was addressed with improved memory management
    cvelistv5
  • 15 DEC 00:00Z
    Added to CISA KEV — remediate by Jan 5
    kev