Skip to main content

Apple Safari CVE-2026-43663

| EUVDEUVD-2026-40210 MEDIUM
Buffer Overflow (CWE-119)
2026-06-29 apple GHSA-h545-qxq5-vpjg
Buffer Overflow Apple Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Web content delivery is network-based with no auth needed; user must visit the page (UI:R); crash-only impact means A:H with C:N and I:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 29, 2026 - 22:39 vuln.today
CVSS changed
Jun 29, 2026 - 22:22 NVD
6.5 (MEDIUM)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
MEDIUM 6.5
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Memory corruption in Apple's WebKit-based web content processing allows an unauthenticated remote attacker to crash the affected process by luring a user to visit a maliciously crafted webpage. Affected platforms include Safari, iOS, iPadOS, and macOS Tahoe, all prior to version 26.5.2. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; impact is limited to availability (process crash) with no confirmed confidentiality or integrity exposure.

Technical ContextAI

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), and the tags confirm a buffer overflow root cause. Apple's advisory language - 'addressed with improved memory handling' - is consistent with an out-of-bounds read or write in the WebKit rendering engine, which is the shared HTML/CSS/JavaScript parsing and rendering library underlying Safari on macOS (cpe:2.3:a:apple:safari), as well as all browser engines on iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados) due to Apple's platform policy mandating WebKit. The macOS component (cpe:2.3:a:apple:macos) is likely affected through Safari or WebKit-consuming apps. Parsing or rendering specially crafted web content can trigger the improper memory operation, resulting in an unexpected process termination rather than arbitrary code execution, based on the A:H/C:N/I:N CVSS impact vector.

RemediationAI

Vendor-released patch: Safari 26.5.2, iOS 26.5.2 / iPadOS 26.5.2, and macOS Tahoe 26.5.2. Users should update via Software Update on macOS or Settings > General > Software Update on iOS/iPadOS; Safari on macOS updates through the App Store or System Preferences. Apple advisory pages at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 provide release details. If immediate patching is not possible, restricting access to untrusted websites via content filtering (e.g., enterprise DNS/proxy block lists) reduces exposure but does not eliminate it, as any user-controlled browsing session could reach a malicious page. For managed device fleets, enforcing MDM-based OS update policies is the recommended compensating control, with the trade-off that forced update pushes may disrupt user workflows during rollout.

More in Ios And Ipados

View all
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-43807 CRITICAL
9.8 Jul 27

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
CVE-2026-64733 CRITICAL
9.8 Jul 27

A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
CVE-2026-43799 CRITICAL
9.8 Jul 27

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
CVE-2026-64700 CRITICAL
9.8 Jul 27

Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-43663 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy