CoreCVE
Back

HIGH

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Published Dec 17, 2025

Description

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Affected products

Remediation

Red Hat statement

To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity. Additionally, this issue can cause an unexpected crash but the possibility of remote code execution is not discarded.

Red Hat mitigation

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Weaknesses (1)

CWE-843

References (11)

Change history (3)
  1. CISA ADP

    • SSVC technical impact

      changed from total to partial

  2. CISA ADP

    • SSVC technical impact

      changed from partial to total

  3. CISA ADP

    • SSVC technical impact

      changed from total to partial

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apple
Published Dec 17, 2025
Updated Apr 2, 2026
Reserved Apr 16, 2025
Link CVE-2025-43541
CISA Vulnrichment
Updated Dec 17, 2025
NVD
Status Analyzed
Modified Oct 7, 2026
Link CVE-2025-43541
Red Hat
Severity Important
Public date Dec 17, 2025
Links CVE-2025-43541 - Bugzilla
ENISA EUVD
Assigner apple
Published Dec 17, 2025
Updated Apr 2, 2026
Exploited since n/a
Link EUVD-2025-203967
EUVD-2025-203967