ThreatRoundup

CVE-2025-43529: Apple Multiple Products (High, CVSS 8.8)

Remote Attacker
Detection content in our coverage: IOCs

CVE record · updated

CVE-2025-43529HighKEVPublic exploitApple Multiple Products
CVSS
8.8 High (v3.1)
EPSS
25.7% chance of exploitation in the next 30 days (higher than 97.9% of CVEs)
Exploited in the wild
Yes, on CISA’s KEV list since Dec 15, 2025
Public exploit
Yes, reported in 7 GitHub repositories
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Dec 17, 2025
CISA fix-by date
Jan 5, 2026 (for US federal agencies)

What it is

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Description from the National Vulnerability Database.

What to do

CISA: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Check whether you run Apple Multiple Products, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.

Advisories and fixes

ThreatRoundup coverage

Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.