◆
webkit security monitor
autonomous cve → commit → rca pipeline

CVE-2025-43457

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Gary Kwong, Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Attribute Value
CVE CVE-2025-43457
Bugzilla 298606
Component JSC
Bug Class UAF
Severity medium
Commit f014a32890763b13…
Advisory Apple Advisory

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

  • Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
  • Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
  • Source/JavaScriptCore/dfg/DFGClobberize.h
  • Source/JavaScriptCore/dfg/DFGCloneHelper.h
  • Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
  • Source/JavaScriptCore/dfg/DFGDoesGC.cpp
  • Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
  • Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp
  • Source/JavaScriptCore/dfg/DFGMayExit.cpp
  • Source/JavaScriptCore/dfg/DFGNode.cpp
  • Source/JavaScriptCore/dfg/DFGNode.h
  • Source/JavaScriptCore/dfg/DFGNodeType.h
  • Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
  • Source/JavaScriptCore/dfg/DFGObjectMaterializationData.h
  • Source/JavaScriptCore/dfg/DFGOperations.cpp
  • Source/JavaScriptCore/dfg/DFGOperations.h
  • Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
  • Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h
  • Source/JavaScriptCore/dfg/DFGSafeToExecute.h
  • Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
  • Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
  • Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
  • Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
  • Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
  • Source/JavaScriptCore/dfg/DFGUseKind.h
  • Source/JavaScriptCore/dfg/DFGValidate.cpp
  • Source/JavaScriptCore/ftl/FTLCapabilities.cpp
  • Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp
  • Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
  • Source/JavaScriptCore/ftl/FTLOperations.cpp
  • Source/JavaScriptCore/runtime/IndexingType.cpp
  • Source/JavaScriptCore/runtime/IndexingType.h

Test Files

  • JSTests/stress/array-allocation-elimination-closure-capture.js
  • JSTests/stress/array-allocation-elimination-conditional-usage.js
  • JSTests/stress/array-allocation-elimination-cross-function.js