CVE-2025-43272: Apple Safari DOS Vulnerability

CVE-2025-43272 Overview

CVE-2025-43272 is a memory handling vulnerability affecting Apple Safari and multiple Apple operating systems. Processing maliciously crafted web content can trigger an unexpected Safari crash, resulting in denial of service on affected systems. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and requires user interaction, such as visiting a malicious webpage. Apple addressed the issue with improved memory handling in Safari 26, iOS 26, iPadOS 26, macOS Tahoe 26, visionOS 26, and watchOS 26.

Critical Impact
A remote attacker can crash Safari on unpatched Apple devices by luring users to malicious web content, disrupting browser availability across desktop, mobile, wearable, and spatial computing platforms.

Affected Products

Apple Safari (versions prior to Safari 26)
Apple iOS and iPadOS (versions prior to 26)
Apple macOS Tahoe (versions prior to 26), visionOS (prior to 26), and watchOS (prior to 26)

Discovery Timeline

2025-09-15 - CVE-2025-43272 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-43272

Vulnerability Analysis

The vulnerability resides in Safari's handling of web content and stems from improper memory management during content processing. When Safari parses maliciously crafted web content, memory operations exceed intended bounds, corrupting internal state and causing the browser process to terminate unexpectedly. Apple describes the fix as involving improved memory handling, indicating the root defect involved unsafe access to a buffer or object during rendering or script execution. Because the flaw is reachable through web content, any WebKit-based context on the affected operating systems is exposed. Impact is limited to availability, with no confidentiality or integrity loss reported by the vendor.

Root Cause

The root cause is a memory safety defect classified under [CWE-119]. Safari failed to correctly bound memory operations while processing attacker-controlled web content, producing an unrecoverable error state. Apple mitigated the condition by tightening memory handling in the affected code paths rather than by input filtering, which suggests the defect was a low-level buffer boundary or lifetime issue rather than a validation gap.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts crafted web content on a controlled site or delivers it through a link, advertisement, or embedded frame. When a target visits the resource in Safari or any WebKit-backed view on iOS, iPadOS, macOS Tahoe, visionOS, or watchOS, the browser process crashes. No authentication or elevated privileges are required. A public proof-of-concept was not observed at the time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

A verified exploit code sample is not publicly available. Refer to the Apple Security Update 125108 and the Full Disclosure Mailing List #53 posting for additional technical context.

Detection Methods for CVE-2025-43272

Indicators of Compromise

Repeated unexpected termination of the Safari process or WebKit-backed applications following navigation to untrusted URLs.
Crash reports referencing WebKit or JavaScriptCore frames in ~/Library/Logs/DiagnosticReports/ on macOS or in device analytics on iOS and iPadOS.
Outbound requests from managed devices to newly registered or low-reputation domains preceding browser crash events.

Detection Strategies

Correlate Safari and WebKit crash telemetry with browsing history and network logs to identify pages that consistently trigger termination.
Deploy web filtering and threat intelligence feeds to flag delivery of suspected exploit URLs to unpatched endpoints.
Inventory Safari and OS build versions across the fleet to identify hosts still running builds prior to the version 26 releases.

Monitoring Recommendations

Enable centralized collection of macOS unified logs and iOS device analytics to surface repeated com.apple.WebKit.WebContent crashes.
Monitor endpoint telemetry for anomalous browser process exits correlated with specific domains or ad networks.
Track patch compliance for Safari 26, iOS 26, iPadOS 26, macOS Tahoe 26, visionOS 26, and watchOS 26 through mobile device management tooling.

How to Mitigate CVE-2025-43272

Immediate Actions Required

Update all Apple devices to Safari 26, iOS 26, iPadOS 26, macOS Tahoe 26, visionOS 26, or watchOS 26 as applicable.
Push updates through mobile device management to enforce compliance on managed endpoints and prevent version drift.
Advise users to avoid untrusted links and enable automatic Safari and OS updates until patch deployment is confirmed.

Patch Information

Apple released fixes across multiple platform advisories. Consult the Apple Security Update 125108, Apple Security Update 125113, Apple Security Update 125115, and Apple Security Update 125116 for the specific builds addressing CVE-2025-43272. Additional context appears in the OpenWall OSS-Security post.

Workarounds

Restrict browsing to trusted sites and disable JavaScript for high-risk contexts where feasible until patches are applied.
Use enterprise web gateways to block access to known malicious or newly registered domains that may host crafted content.
Consider temporarily routing web traffic through a hardened, non-WebKit browser on macOS where operational policy allows.

bash

# Verify Safari and macOS versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString