In CISA KEVNot scored
CVE-2025-43529
Apple Multiple Products Use-After-Free WebKit Vulnerability
AppleMultiple Products
Status
- Exploited in the wild
- In CISA KEV since 15 Dec 2025
- Vendor fix available
Federal deadlineMon 5 Jan, 23:59 UTC
Passed 292 days ago
CISA KEV · added 15 Dec 2025
Exploit probabilityEPSSchecked 25 Oct
8.8%probability of exploitation in the next 30 days
Higher than 95% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS CVE-2025-14174 was also issued in response to this report.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 12 Feb · 04:01 UTC | SecurityOnline | Apple Zero-Day (CVE-2026-20700) Exploited in the Wild |
| Thu 12 Feb · 07:25 UTC | The Hacker News | Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices |
| Thu 12 Feb · 08:01 UTC | SecurityWeek | Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’ |
| Thu 12 Feb · 11:25 UTC | Security Affairs | Apple fixed first actively exploited zero-day in 2026 |
| Thu 12 Feb · 12:25 UTC | Malwarebytes | Apple patches zero-day flaw that could let attackers take control of devices |
| Thu 19 Mar · 09:59 UTC | The Hacker News | DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover |
| Thu 19 Mar · 15:04 UTC | Security Affairs | DarkSword emerges as powerful iOS exploit tool in global attacks |
- DarkSword emerges as powerful iOS exploit tool in global attacksSecurity Affairs · mentions it in passing
- DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device TakeoverThe Hacker News · mentions it in passing
- Apple patches zero-day flaw that could let attackers take control of devicesMalwarebytes · mentions it in passing
- Apple fixed first actively exploited zero-day in 2026Security Affairs · mentions it in passing
- Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’SecurityWeek · mentions it in passing
- Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple DevicesThe Hacker News · mentions it in passing
- Apple Zero-Day (CVE-2026-20700) Exploited in the WildSecurityOnline · first in our coverage · mentions it in passing