Released December 12, 2025

CVE-2025-14174

CVSS 8.8 severity high CWE-787CWE-119 ⚠ CISA KEV vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Overview

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report.

Researchers: Apple and Google Threat Analysis Group

Background

Advisory: Apple Security Advisory

Attribute	Value
CVE	CVE-2025-14174
Bugzilla	303614
Component	WebKit
Bug Class	LogicError
Severity	medium
Advisory	Apple Advisory

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

A memory corruption issue was addressed with improved validation.

Audit Directions

When auditing for this vulnerability, focus on: (1) similar patterns in the patched functions and nearby code, (2) missing or insufficient bounds checks on user-controlled input, (3) unvalidated type conversions and pointer arithmetic, (4) edge cases not exercised by tests, and (5) copy-paste variants of the vulnerable logic elsewhere.