⚠ Actively exploited
Added to CISA KEV on 2025-12-15. Federal agencies required to patch by 2026-01-05. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-43529 — Use After Free in Apple IOS AND Ipados

CWE-416 — Use After FreeCWE-825 — Expired Pointer Dereference28 documents12 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 64.09%
CISA KEV
KEV
Added 2025-12-15
Due 2026-01-05
Exploit
No known exploits
Affected products
8
Apple IOS AND IpadosApple MacosApple Safari+5 more
Timeline
KEV addedDec 15
PublishedDec 17
KEV dueJan 5
Latest updateApr 1
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages13 packages

▶NVDapple/ipados26.0 — 26.2+1
▶CVEListV5apple/ios_and_ipados< 18.7.3+1
▶CVEListV5apple/tvos< 26.2
▶NVDapple/tvos< 26.2
▶CVEListV5apple/macos< 26.2

🔴Vulnerability Details

5
GHSA
GHSA-m9mp-fmfc-g6gc: A use-after-free issue was addressed with improved memory management↗2025-12-17
▶
CVEList
CVE-2025-43529: A use-after-free issue was addressed with improved memory management↗2025-12-17
▶
OSV
CVE-2025-43529: A use-after-free issue was addressed with improved memory management↗2025-12-17
▶
OSV
CVE-2025-43529: A use-after-free issue was addressed with improved memory management↗2025-12-17
▶
VulnCheck
Apple Multiple Products Use-After-Free WebKit Vulnerability↗2025
▶

📋Vendor Advisories

16
Apple
CVE-2025-43529: tvOS 26.3↗2026-02-11
▶
Apple
CVE-2025-43529: iOS 26.3 and iPadOS 26.3↗2026-02-11
▶
Apple
CVE-2025-43529: watchOS 26.3↗2026-02-11
▶
Apple
CVE-2025-43529: visionOS 26.3↗2026-02-11
▶
Apple
CVE-2025-43529: macOS Tahoe 26.3↗2026-02-11
▶

🕵️Threat Intelligence

5
Bleepingcomputer
Apple expands iOS 18 updates to more iPhones to block DarkSword attacks↗2026-04-01
▶
Bleepingcomputer
New DarkSword iOS exploit used in infostealer attack on iPhones↗2026-03-18
▶
Bleepingcomputer
Apple fixes zero-day flaw used in &#039;extremely sophisticated&#039; attacks↗2026-02-11
▶
Bleepingcomputer
Apple fixes two zero-day flaws exploited in &#039;sophisticated&#039; attacks↗2025-12-12
▶
Wiz
CVE-2025-43529 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-43529 — Use After Free in Apple IOS AND Ipados | cvebase