CVE-2025-43421

MediumCVSS 4.3

Published: 04/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.65%

50th percentile - higher than 50% of all known CVEs

Summary

Multiple issues were addressed by disabling array allocation sinking. The vulnerability affects Safari, iOS, iPadOS, macOS Tahoe and visionOS. Processing maliciously crafted web content may lead to an unexpected process crash.

Risk Assessment

Users visiting malicious websites may experience browser or application crashes, which could be used to destabilize the system.

Recommendation

Update Safari, iOS/iPadOS, macOS Tahoe and visionOS to version 26.1 or later.

Other vulnerabilities in Safari / WebKit

CVE-2025-43356Medium
The issue was addressed with improved handling of caches. The vulnerability affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. A website may be able to access sensor information without user consent.

Original NVD description (English source)

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS