CVE-2025-43480
High · 8.1CVSS
8.1
EPSS
0.5%
Published
Nov 4, 2025
CISA due date
—
The record
The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | webkit2gtk3 | 0 | 2.50.3-1.el8_10 |
| AlmaLinux:8 | webkit2gtk3-devel | 0 | 2.50.3-1.el8_10 |
| AlmaLinux:8 | webkit2gtk3-jsc | 0 | 2.50.3-1.el8_10 |
| AlmaLinux:8 | webkit2gtk3-jsc-devel | 0 | 2.50.3-1.el8_10 |
| AlmaLinux:9 | webkit2gtk3 | 0 | 2.50.3-1.el9_7 |
| AlmaLinux:9 | webkit2gtk3-devel | 0 | 2.50.3-1.el9_7 |
| AlmaLinux:9 | webkit2gtk3-jsc | 0 | 2.50.3-1.el9_7 |
| AlmaLinux:9 | webkit2gtk3-jsc-devel | 0 | 2.50.3-1.el9_7 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 16.0 | webkit2gtk3 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk3-soup2 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk4 | 0 | 2.50.4-160000.1.1 |
Related vulnerabilities
- CVE-2025-43536 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3
- CVE-2025-43531 A race condition was addressed with improved state handling. Also affects webkit2gtk3
- CVE-2025-43529 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3
- CVE-2023-43000 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3
- CVE-2025-43458 This issue was addressed through improved state management. Also affects webkit2gtk3
- CVE-2025-43443 This issue was addressed with improved checks. Also affects webkit2gtk3
- CVE-2025-43432 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3
- CVE-2025-43434 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3