DNA View

⚠️ CISA Known Exploited Vulnerability

Active Threat

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.

CVE-2025-43529

High CISA KEV
Low Medium High Critical
8.8
CVSS Score
Published: Dec 17, 2025
Last Modified: Dec 18, 2025

Vulnerability Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
R
Scope
U
Confidentiality
H
Integrity
H
Availability
H

Available Security Patches

3 patches available from vendors

View All Patches
Canonical (Ubuntu)

USN-7957-1

USN-7957-1: WebKitGTK vulnerabilities

Severity
Unknown
Released
Jan 13, 2026
Security Update
SUSE

CVE-2025-43529

CVE-2025-43529

Severity
Unknown
Released
Dec 23, 2025
Security Update
Debian

DSA-6083-1

DSA-6083-1 webkit2gtk - security update

Severity
Unknown
Released
Dec 18, 2025
Security Update

Severity Details

8.8
out of 10.0
High

CISA KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog

Key Information

Published Date
December 17, 2025