CVE-2025-43343

moderate-risk
Published 2025-09-15

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (9)

Affected Vendors

Apple Webkitgtk Wpewebkit

References (15)

Release Notes https://support.apple.com/en-us/125108
https://support.apple.com/en-us/125110
Release Notes https://support.apple.com/en-us/125113
Release Notes https://support.apple.com/en-us/125114
Release Notes https://support.apple.com/en-us/125115
Release Notes https://support.apple.com/en-us/125116
Mailing List http://seclists.org/fulldisclosure/2025/Sep/49
Mailing List http://seclists.org/fulldisclosure/2025/Sep/53
Mailing List http://seclists.org/fulldisclosure/2025/Sep/57
Mailing List http://seclists.org/fulldisclosure/2025/Sep/59
Mailing List http://www.openwall.com/lists/oss-security/2025/10/13/4
https://access.redhat.com/errata/RHSA-2025:19946
https://security-tracker.debian.org/tracker/CVE-2025-43343
https://ubuntu.com/security/CVE-2025-43343
https://webkitgtk.org/security/WSA-2025-0007.html
48
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 15/34 · Moderate