EUVD-2026-40187
GHSA-pjj4-c265-fwjm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered via web content, low complexity, no privileges; user must visit page (UI:R); crash only, no confirmed confidentiality or integrity impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
AnalysisAI
Out-of-bounds read in Apple's WebKit rendering engine crashes the browser process when parsing maliciously crafted web content, affecting Safari, iOS, iPadOS, and macOS Tahoe prior to version 26.5.2. The vulnerability requires only that a user visit or be redirected to an attacker-controlled page, making it trivially deliverable via phishing or malicious advertising. Impact is limited to a denial-of-service process crash per vendor disclosure; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a condition where software reads data beyond the allocated memory buffer boundary. In WebKit, the engine responsible for rendering web content across all Apple platforms (Safari, all iOS/iPadOS browsers via the WebKit mandate, and macOS apps using WKWebView), maliciously crafted HTML, JavaScript, or media payloads can trigger a parser or layout component to read past a buffer's end. This commonly arises in complex parsing pipelines - image decoders, JavaScript JIT compilers, CSS layout engines - where size validation is absent or insufficient. CPE data confirms affected products are cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, spanning all versions prior to the 26.5.2 train. Apple addressed the root cause with improved bounds checking, consistent with typical WebKit memory-safety mitigations.
RemediationAI
The primary fix is to update to vendor-released patch versions: Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2. Updates are available via Apple Software Update and detailed in vendor advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. For iOS and iPadOS devices that cannot be immediately updated, enabling 'Lockdown Mode' substantially reduces the browser attack surface by restricting complex web content rendering, though this carries significant usability trade-offs for most users. Organizations managing enterprise Apple fleets should deploy updates via MDM. No meaningful workaround exists that preserves normal web browsing functionality, as the vulnerable code path is triggered by routine web content processing.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today