Skip to main content

Apple Safari CVE-2026-39872

| EUVDEUVD-2026-40214 MEDIUM
Buffer Overflow (CWE-119)
2026-06-29 apple GHSA-3pf9-4p9r-8vcp
Buffer Overflow Apple Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network delivery via web content with mandatory user interaction; crash limited to browser process with no confidentiality or integrity impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 29, 2026 - 22:41 vuln.today
CVSS changed
Jun 29, 2026 - 22:22 NVD
6.5 (MEDIUM)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
MEDIUM 6.5
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Processing maliciously crafted web content in Apple Safari, iOS/iPadOS, and macOS Tahoe (all versions prior to 26.5.2) triggers an improper memory handling flaw (CWE-119 buffer overflow) in the web content processing pipeline, resulting in an unexpected process crash. The attack vector is network-based requiring user interaction (UI:R per CVSS), and impact is confined to availability - no confidentiality or integrity compromise is described. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), consistent with a buffer overflow or out-of-bounds memory access condition. Given Apple's advisory language of 'improved memory handling' and the web content processing trigger, the flaw almost certainly resides within WebKit, Apple's open-source browser rendering engine. WebKit is shared across all three affected platforms: Safari (cpe:2.3:a:apple:safari:*), iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados:*), and macOS Tahoe (cpe:2.3:a:apple:macos:*). Critically, iOS and iPadOS mandate WebKit as the browser engine for all apps - meaning every third-party browser on those platforms (Chrome, Firefox, Edge) shares the same vulnerable engine and extends the attack surface beyond Safari alone. The scope is unchanged (S:U), indicating the crash is contained within the sandboxed web content process.

RemediationAI

Apply the vendor-released patches immediately: update to Safari 26.5.2, iOS 26.5.2 / iPadOS 26.5.2, and macOS Tahoe 26.5.2 via Apple Software Update (Settings > General > Software Update on iOS/iPadOS; System Settings > General > Software Update on macOS). Detailed update instructions are available at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. For managed enterprise fleets, use Mobile Device Management (MDM) - such as Jamf or Apple Business Manager - to push the update to all enrolled iOS/iPadOS and macOS devices. As an interim compensating control, restricting end-user browsing to approved domains via web content filtering (e.g., DNS-layer filtering) reduces exposure, but this is impractical for general-purpose devices and does not eliminate risk from compromised trusted domains or malicious ads. Disabling JavaScript would prevent most web content exploitation paths but would break the majority of modern web functionality and is not a viable long-term control.

More in Ios And Ipados

View all
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-43807 CRITICAL
9.8 Jul 27

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
CVE-2026-64733 CRITICAL
9.8 Jul 27

A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
CVE-2026-43799 CRITICAL
9.8 Jul 27

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
CVE-2026-64700 CRITICAL
9.8 Jul 27

Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-39872 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy