Use-After-Free Vulnerability in Apple Products
CVE-2025-43438

4.3MEDIUM

Key Information:

Vendor: Apple
Status: Safari; Visionos; Watch OS; iOS And iPad OS
Vendor: CVE Published:; 4 November 2025

What is CVE-2025-43438?

A use-after-free vulnerability has been identified in multiple Apple products, including Safari, that arises from improper memory management. When processing maliciously crafted web content, this flaw can lead to unexpected crashes, potentially exposing users to further risks. Apple has implemented fixes in watchOS 26.1, iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1 to enhance security and performance.

Affected Version(s)

iOS and iPadOS < 26.1

Safari < 26.1

visionOS < 26.1

References

https://support.apple.com/en-us/125640

https://support.apple.com/en-us/125638

https://support.apple.com/en-us/125639

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 4, 2025
Vulnerability Reserved
Apr 16, 2025

JSON