EUVD-2026-40185
GHSA-8w92-3v43-q4p8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Web-delivered attack requires no attacker privileges; user must open malicious content; confirmed impact is process crash only, no confidentiality or integrity effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
AnalysisAI
Out-of-bounds read in Apple's web content processing engine crashes the rendering process across iOS, iPadOS, and macOS Tahoe when a user visits or opens maliciously crafted web content. All iOS and iPadOS versions prior to 26.5.2 and macOS Tahoe versions prior to 26.5.2 are affected per EUVD-2026-40185 and Apple's own advisories. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified; however, the zero-privilege, low-complexity attack path makes denial-of-service accessible to any attacker who can deliver a malicious web page to a victim.
Technical ContextAI
The root cause is CWE-125 (Out-of-bounds Read), a class of memory safety defect in which a program reads data beyond an allocated buffer boundary, typically producing a memory fault that crashes the affected process. Apple's advisory describes the fix as 'improved memory handling,' the standard language Apple uses for memory safety patches in its web rendering stack. On iOS and iPadOS, all browsers and web-capable applications are required to use the WebKit engine, making the entire web-browsing surface of those platforms uniformly vulnerable. On macOS the same WebKit library underpins Safari and system web views. The affected CPEs are cpe:2.3:a:apple:ios_and_ipados:* and cpe:2.3:a:apple:macos:* for all versions below 26.5.2. The 'Buffer Overflow' tag applied in the metadata is technically imprecise for CWE-125, which is a read-only overrun rather than a write beyond bounds; the outcome is a process crash from a memory fault, not a classical stack or heap overflow enabling code injection.
RemediationAI
The definitive fix is to update to iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2, as released by Apple and confirmed in the vendor advisories at https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595. Updates can be applied via Settings > General > Software Update on iOS/iPadOS and System Settings > General > Software Update on macOS. If immediate patching is not operationally feasible, a partial compensating control on managed fleets is to restrict web browsing to approved domains via MDM content filtering policies, which reduces exposure to attacker-controlled web content but incurs significant workflow impact and does not protect against malicious content delivered through trusted domains or embedded web views in third-party apps. There is no vendor-documented workaround that fully substitutes for the patch.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today