CVE-2025-43213 is a vulnerability in Apple Safari caused by improper memory handling when processing maliciously crafted web content, leading to an unexpected crash of the browser. This issue affects Safari versions earlier than 18.6 and related Apple operating systems before their 18.6 (or 11.6 for watchOS) updates. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to availability (crash). Apple fixed the issue by improving memory handling in Safari 18.6 and corresponding OS versions. Red Hat has released security updates for webkitgtk4 on Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this and related WebKitGTK vulnerabilities. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability may cause Safari to crash unexpectedly, resulting in denial of service to the user. There is no indication of confidentiality or integrity impact. The vulnerability requires user interaction (visiting a malicious web page) and can be exploited remotely over the network. The medium severity score reflects the availability impact without privilege or confidentiality compromise.

A fix is available from Apple in Safari 18.6 and corresponding OS updates (iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Users and administrators should update affected Apple devices to these versions or later to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, apply the webkitgtk4 security update (e.g., webkitgtk4-2.52.3-1.el7_9) as detailed in Red Hat advisory RHSA-2026:22136. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without updates.