---
id: "CVE-2025-43529"
kind: "vulnerability"
aliases: ["CVE-2025-43529"]
title: "A use-after-free issue was addressed with improved memory management"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple safari", "fixed": ["26.2"], "affected": "< 26.2", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["18.7.3"], "affected": "< 18.7.3", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["26.2"], "affected": ">= 26.0, < 26.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["18.7.3"], "affected": "< 18.7.3", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.2"], "affected": ">= 26.0, < 26.2", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.2"], "affected": ">= 26.0, < 26.2", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["26.2"], "affected": "< 26.2", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["26.2"], "affected": "< 26.2", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["26.2"], "affected": "< 26.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "ipados", "macos", "safari", "vendor", "webkit"]
not_affected_if: ["unknown"]
published_at: "2025-12-15T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43529", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43529", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# A use-after-free issue was addressed with improved memory management

A use-after-free bug in Apple's WebKit browser engine lets a crafted web page corrupt memory on iOS, iPadOS, macOS and other Apple products. Attackers are already exploiting it in the wild, and it can also affect non-Apple apps that use WebKit to parse HTML.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple safari affected < 26.2 fixed 26.2
- vendor:apple ipados affected < 18.7.3 fixed 18.7.3
- vendor:apple ipados affected >= 26.0, < 26.2 fixed 26.2
- vendor:apple iphone os affected < 18.7.3 fixed 18.7.3
- vendor:apple iphone os affected >= 26.0, < 26.2 fixed 26.2
- vendor:apple macos affected >= 26.0, < 26.2 fixed 26.2
- vendor:apple tvos affected < 26.2 fixed 26.2
- vendor:apple visionos affected < 26.2 fixed 26.2
- vendor:apple watchos affected < 26.2 fixed 26.2

## Fix

Update Apple devices to the latest iOS, iPadOS and macOS releases; the specific fixed versions are unknown from the sources.
For non-Apple apps that embed WebKit, check with the vendor for a patched build.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43529
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-43529

## From the sources

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_