Skip to main content

Safari WebKit CVE-2026-43658

| EUVDEUVD-2026-29303 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-gc3p-ph3x-xqq6
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
7.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim browses to attacker-controlled URL
  2. Delivery
    WebKit loads and parses malicious web content
  3. Exploit
    Memory corruption triggered in content processing
  4. Execution
    Sensitive memory contents exposed
  5. Impact
    Attacker exfiltrates data via JavaScript

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions - remote unauthenticated exploitation against default Safari configurations across all Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack requiring no authentication, low complexity, and critically, no user interaction beyond normal web browsing. Any application using WebKit to render web content is potentially vulnerable, not just Safari itself. Exploitation is NOT limited by user interaction (UI:N contradicts typical web-based attacks requiring user to click or interact), suggesting the vulnerability triggers during automatic content parsing or background processing. This makes it exploitable through automatic page loads, embedded iframes, redirects, or pre-rendered content. The attack scope is unchanged (S:U), meaning exploitation cannot pivot beyond the vulnerable WebKit process, somewhat limiting impact despite the network accessibility.
Impact

The CVSS base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N indicates network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction. However, critical conflicts exist between data sources that significantly affect risk assessment: the CVSS vector specifies C:H/I:N/A:N (high confidentiality impact, no integrity or availability impact) while the vendor description states 'unexpected Safari crash' (pure availability impact). This fundamental contradiction suggests either incorrect CVSS scoring or incomplete vendor disclosure. The EPSS score of 0.02% (5th percentile) indicates security researchers assess actual exploitation probability as very low despite the severe CVSS metrics. No CISA KEV listing and no public exploit code identified at time of analysis. The SSVC framework would classify this as having network attack vector (automatable) but uncertain technical impact due to conflicting impact assessments. Real-world priority: MEDIUM - the theoretical severity is high for information disclosure, but lack of exploitation activity, low EPSS score, and vendor patch availability reduce urgency. Organizations running Apple devices should prioritize patching based on data sensitivity and public network exposure rather than CVSS score alone.
Exploit ScenarioDerived

An attacker hosts maliciously crafted web content on a compromised or attacker-controlled website containing specially formatted HTML, CSS, or JavaScript designed to trigger the memory handling flaw in WebKit. When a victim using an unpatched Apple device browses to the malicious site (or is redirected via advertising networks, phishing links, or watering hole attacks), Safari automatically processes the web content without requiring any user interaction beyond page load. The memory corruption vulnerability triggers, potentially exposing sensitive data from browser memory such as cookies, authentication tokens, or content from other browser tabs, which the attacker exfiltrates through subsequent JavaScript execution or network requests.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Memory corruption in Safari's WebKit engine across all Apple platforms allows remote attackers to trigger information disclosure via maliciously crafted web content delivered through network-accessible attack vectors requiring no authentication or user interaction. Despite the vendor description focusing on crash scenarios, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no availability impact, suggesting potential memory disclosure rather than denial of service. Patched in iOS/iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite network-accessible attack vector.

RemediationAI

Apply vendor-released patches by updating to iOS/iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5 as appropriate for each device type. Detailed security update documentation available at https://support.apple.com/en-us/127110 (iOS/iPadOS), https://support.apple.com/en-us/127115 (macOS), https://support.apple.com/en-us/127118 (tvOS), https://support.apple.com/en-us/127119 (visionOS), and https://support.apple.com/en-us/127120 (watchOS). For environments unable to immediately patch, implement network-level content filtering to block access to untrusted websites, though this significantly degrades user experience and may not be feasible for general-purpose devices. Alternatively, disable JavaScript in Safari (Settings > Safari > Advanced > JavaScript) to reduce attack surface, but this breaks most modern web applications and is only viable for limited-use devices. Enterprise environments can restrict web browsing to approved domains via MDM profiles (com.apple.webcontent-filter payload), trading functionality for temporary risk reduction until patching is complete.

Affected VersionsENISA

tvOS 0 <26.5
visionOS 0 <26.5
macOS 0 <26.5
watchOS 0 <26.5
iOS and iPadOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects WebKit, Apple's browser engine used across all Apple platforms for rendering web content in Safari and other applications. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), commonly known as buffer overflow. The affected component processes web content including HTML, CSS, JavaScript, and multimedia resources. The discrepancy between the vendor's description (Safari crash/availability) and the CVSS vector (high confidentiality impact, no availability impact) suggests the underlying memory handling flaw may expose sensitive memory contents during web content processing, with crashes potentially being a secondary symptom. All Apple operating systems share the same WebKit codebase, explaining the simultaneous patching across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS platforms.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 18:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:18 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:08 nvd
HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive ViewAI

Why It Matters

CVE-2026-43658 is a memory disclosure vulnerability in Apple's WebKit engine affecting Safari across iOS, macOS, tvOS, visionOS, and watchOS that enables unauthenticated remote attackers to extract sensitive information through maliciously crafted web content without user interaction. Organizations with macOS, iOS, or iPad deployments face confidentiality risk as users browsing untrusted content could leak cached credentials, authentication tokens, or other sensitive data resident in browser memory. Despite low exploitation likelihood (0.0% EPSS), the network-accessible attack vector and lack of user interaction requirements warrant timely patching to prevent targeted information theft.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict affected Safari instances from accessing untrusted or external websites via URL filtering and network segmentation; enable forced HTTPS enforcement and consider blocking older Safari user agents at perimeter. However, these controls are incomplete mitigations and do not address the underlying vulnerability-timely patching is the primary control.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43658 ADVISORY https://vuldb.com/vuln/362859 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-43658 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483968 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43658.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121 REF https://support.apple.com/en-us/148287

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy