Vulnerabilities

CVSS

8.8 High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2025-12-17

Status

Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Weaknesses

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.CWE-416

Coverage 1

threat-intel

Coruna, DarkSword iOS Exploits Proliferate Globally

Sophisticated iPhone exploit chains, DarkSword and Coruna, are rapidly spreading beyond nation-state actors and into the hands of organized cybercrime groups. These advanced tools, initially developed for surveillance an…

Dark Reading · Aug 10, 2026 High

CVE-2025-31277CVE-2025-43529CVE-2026-20700CHMASAexploitioscybercrime

All articles mentioning it

Advisories and references

• support.apple.com/en-us/125884
• support.apple.com/en-us/125885
• support.apple.com/en-us/125886
• support.apple.com/en-us/125889
• support.apple.com/en-us/125890
• support.apple.com/en-us/125891
• support.apple.com/en-us/125892
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...