{"answers":{"affected":"It affects 7 products.","exploited":"Yes. Attackers have exploited CVE-2025-43529 in the wild since at least 15 Dec 2025.","fix":"Apply the vendor's patch. US federal agencies must fix it by 5 Jan 2026.","what":"CVE-2025-43529 is a high-severity use after free vulnerability in Apple Ipados, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-43529 and fix it if it is affected.\n\nWhat it is: CVE-2025-43529 is a high-severity use after free vulnerability in Apple Ipados, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: Yes. Attackers have exploited CVE-2025-43529 in the wild since at least 15 Dec 2025.\n\nAffected product: Apple Ipados. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-43529/ (Markdown: https://insights.sbomify.com/CVE-2025-43529/index.md)","id":"CVE-2025-43529","markdown":"https://insights.sbomify.com/CVE-2025-43529/index.md","name":"CVE-2025-43529","record":{"aliases":["DEBIAN-CVE-2025-43529","GHSA-m9mp-fmfc-g6gc","UBUNTU-CVE-2025-43529"],"analysis":{"component_type":"browser","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Apple Safari browser","requires_auth":"none","summary":"Processing malicious web content in Apple Safari may lead to arbitrary code execution via a use-after-free vulnerability.","user_interaction":"required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apple","cpe":[{"product":"ipados","vendor":"apple"},{"product":"iphone_os","vendor":"apple"},{"product":"macos","vendor":"apple"},{"product":"safari","vendor":"apple"},{"product":"tvos","vendor":"apple"},{"product":"visionos","vendor":"apple"},{"product":"watchos","vendor":"apple"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-01-05","github_poc":7,"max_poc_stars":114,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-01-13T04:35:00Z","kind":"github_poc","ref":"https://github.com/0xjohnnydev/WebKit-UAF-ANGLE-OOB-Analysis","stars":114,"title":"Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari"},{"date":"2026-06-11T04:48:56Z","kind":"github_poc","ref":"https://github.com/GenericCoding/pois0nSword","stars":109,"title":"A demonstration of read write using cve-2025-43529 and userland PAC bypass on iOS 26.1"},{"date":"2026-01-05T23:43:41Z","kind":"github_poc","ref":"https://github.com/jir4vv1t/CVE-2025-43529","stars":87,"title":"exploit for cve-2025-43529"},{"date":"2026-02-01T11:36:10Z","kind":"github_poc","ref":"https://github.com/bjrjk/CVE-2025-43529","stars":18,"title":"Root Cause Analysis for CVE-2025-43529, a UAF vulnerability due to incorrect DFG StoreBarrierInsertionPhase in JavaScriptCore."},{"date":"2026-01-28T03:50:01Z","kind":"github_poc","ref":"https://github.com/SimoesCTT/Convergent-Time-Theory-Enhanced-iOS-Safari-RCE-CVE-2025-43529-","stars":1,"title":"CTT-Enhanced iOS Safari Exploit (based on CVE-2025-43529)"},{"date":"2026-01-30T10:48:22Z","kind":"github_poc","ref":"https://github.com/SimoesCTT/CTT-Apple-Silicon-Refraction","stars":1,"title":"webkit_refraction.js (The 33-Layer WebGL Payload) ​This JavaScript payload uses the \\alpha constant to create a high-frequency \"Memory Shiver.\" It induces the Use-After-Free (UAF) in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal command buffer."},{"date":"2026-03-02T04:23:54Z","kind":"github_poc","ref":"https://github.com/kmeps4/bugtest","stars":1,"title":"CVE-2025-43529 Test"}],"tier":"exploited"},"has_fix":true,"headline":"Apple Multiple Products Use-After-Free WebKit","id":"CVE-2025-43529","indexable":true,"kev":{"dateAdded":"2025-12-15","dueDate":"2026-01-05","knownRansomwareCampaignUse":"Unknown","product":"Multiple Products","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","vendorProject":"Apple","vulnerabilityName":"Apple Multiple Products Use-After-Free WebKit Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":"apple:ipados","products":["apple:ipados","apple:iphone_os","apple:macos","apple:safari","apple:tvos","apple:visionos","apple:watchos"],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":7,"next":{"headline":"Information disclosure in iOS and iPadOS","id":"CVE-2025-43530"},"packages":[],"prev":{"headline":"Privilege escalation in macOS","id":"CVE-2025-43527"},"products":["Safari","iOS and iPadOS","macOS","tvOS","visionOS","watchOS"],"published":"2025-12-17","related":[{"cvss_score":10,"headline":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write","id":"CVE-2025-43300","kev_date_added":"2025-08-21","published":"2025-08-21"},{"cvss_score":10,"headline":"Apple Multiple Products WebKit Out-of-Bounds Write","id":"CVE-2025-24201","kev_date_added":"2025-03-13","published":"2025-03-11"},{"cvss_score":10,"headline":"Apple Multiple Products Use-After-Free","id":"CVE-2025-24085","kev_date_added":"2025-01-29","published":"2025-01-27"},{"cvss_score":9.8,"headline":"Apple Multiple Products Memory Corruption","id":"CVE-2025-31200","kev_date_added":"2025-04-17","published":"2025-04-16"},{"cvss_score":9.8,"headline":"Apple Multiple Products Arbitrary Read and Write","id":"CVE-2025-31201","kev_date_added":"2025-04-17","published":"2025-04-16"},{"cvss_score":9.8,"headline":"Apple Memory Corruption","id":"CVE-2022-22587","kev_date_added":"2022-01-28","published":"2022-03-18"},{"cvss_score":9.8,"headline":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution","id":"CVE-2021-1870","kev_date_added":"2021-11-03","published":"2021-04-02"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-21","vendors":["Apple"]},"summary":"Processing malicious web content in Apple Safari may lead to arbitrary code execution via a use-after-free vulnerability.","url":"https://insights.sbomify.com/CVE-2025-43529/"}