CVE-2025-43441

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-43436

CVE-2025-43436 is a permissions issue affecting Apple OS components (notably CoreServices) where an app may enumerate a user’s installed apps. The connected Nessus entry for Apple TV (and related Apple platforms) confirms CoreServices involvement and ties the CVE to an exposure of installed apps....

CVE-2025-43436

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to enumerate a user's installed apps...

CVE-2025-43421

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-43323

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to fingerprint the user...

CVE-2025-43440

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-43496

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off...

CVE-2025-43496

The CVE-2025-43496 issue affects Apple platforms (watchOS 26.1; macOS Tahoe 26.1; iOS 26.1/iPadOS 26.1; iOS 18.7.2/iPadOS 18.7.2; macOS Sequoia 15.7.2; visionOS 26.1). Description: remote content could be loaded even when the device setting Load Remote Images is off. Root cause: insufficient logi...

CVE-2025-43438

CVE-2025-43438 is a use-after-free memory management vulnerability affecting WebKit-related components. The NVD entry notes a memory-management flaw that, when triggered by processing malicious web content, may cause an unexpected Safari crash with a base score of 8.8 (HIGH) and network attack ve...

CVE-2025-43438

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2025-43438

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2025-43480

CVE-2025-43480 is a cross-origin data exfiltration vulnerability impacting Apple platforms and Safari/WebKit in general. The issue is addressed with improved checks and is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1. The CVSSv3.1 score...

CVE-2025-43480

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin...

CVE-2025-43443

CVE-2025-43443 affects WebKitGTK (webkitgtk4). It corresponds to processing maliciously crafted web content that may lead to an unexpected process crash. In the connected advisories, ALAS2-2025-3114 (Amazon Linux 2) fixes this via updates to webkitgtk4 to 2.50.4-1.amzn2.* across architectures; De...

CVE-2025-43443

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-43455

A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. A malicious app may be able to take a screenshot of sensitive information in embedded views...

CVE-2025-43434

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2025-43434

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2025-43434

CVE-2025-43434 is a use-after-free in WebKitGTK/WebKit that can cause a crash when processing crafted web content. Connected advisories show affected package webkitgtk4 and related WebKitGTK/WebKit components; fixes are shipped as webkitgtk4-2.50.4-1.amzn2.* for Amazon Linux 2 (and corresponding ...

CVE-2025-43361

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A malicious app may be able to read kernel memory...