CVE-2025-43438 is a use-after-free vulnerability (CWE-416) in the WebKitGTK component used by Apple Safari and related platforms. The flaw arises from improper memory management when processing maliciously crafted web content, potentially leading to an unexpected crash of the Safari process. The vulnerability affects Safari versions prior to 26.1 and corresponding OS versions. Red Hat's advisory details that exploitation requires tricking a user into loading malicious web content, with the possibility of denial of service and potential remote code execution. The issue is fixed in Safari 26.1 and related OS updates, as well as in WebKitGTK4 updates for Red Hat Enterprise Linux 7. Mitigations include avoiding processing untrusted web content and removing packages dependent on WebKitGTK4 where feasible.

The vulnerability can cause an unexpected crash of the Safari or WebKitGTK process, resulting in denial of service. Although primarily a crash issue, the possibility of remote code execution exists due to the use-after-free condition. Exploitation requires user interaction to load malicious web content. Red Hat rates the severity as important and assigns a CVSS v3 score of 8.8 for its products, while the Apple CVSS score is 4.3 (medium). The impact includes potential memory corruption, process crashes, and possible unauthorized code execution.

A fix is available in Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1, and WebKitGTK4 updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users and administrators should apply these official updates promptly. To mitigate risk before patching, avoid processing or loading untrusted or malicious web content. On Red Hat systems, consider removing packages that depend on WebKitGTK4 if they are not required, noting that some removals may affect GNOME functionality. WebKitGTK3 can be removed without consequence. No additional action is required if the system is updated to the fixed versions.