CVE-2025-43529 Apple Multiple Products Use-After-Free WebKit

Exploited in the wild High 8.8 Published 17 Dec 2025 Updated 21 Sep 2026

Processing malicious web content in Apple Safari may lead to arbitrary code execution via a use-after-free vulnerability.

Exploited in the wild: Since 15 Dec 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-43529?

CVE-2025-43529 is a high-severity use after free vulnerability in Apple Ipados, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Weakness: CWE-416

Which versions are affected by CVE-2025-43529?

It affects 7 products.

Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Safari, Apple Tvos, Apple Visionos and 1 more.

How do I fix CVE-2025-43529?

Apply the vendor's patch. US federal agencies must fix it by 5 Jan 2026.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2025-43529 being exploited?

Yes. Attackers have exploited CVE-2025-43529 in the wild since at least 15 Dec 2025.

Public exploit code: 7 proofs of concept on GitHub.

All Apple Ipados vulnerabilities

Sources

Also known as DEBIAN-CVE-2025-43529, GHSA-m9mp-fmfc-g6gc, UBUNTU-CVE-2025-43529.