What is the CVSS score of CVE-2026-43706?

CVE-2026-43706 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43706?

Yes, a patch is available for CVE-2026-43706. Update the affected software to the latest version immediately.

Apple iOS/iPadOS CVE-2026-43706

EUVD-2026-40208 MEDIUM

Double Free (CWE-415)

2026-06-29 apple

GHSA-g38x-fqx6-c9wx

Denial Of Service Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Web content delivery is network-based requiring no privileges; user must visit the page (UI:R); only a process crash results, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:39 vuln.today

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:43 cve.org

MEDIUM 6.5

DescriptionCVE.org

A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Double free memory corruption in Apple's web content processing engine crashes the rendering process on iOS/iPadOS (pre-26.5.2) and macOS Tahoe (pre-26.5.2) when a device processes attacker-controlled web content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network delivery with no authentication required, though a user must interact with the malicious content, and impact is limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in a lower active-risk tier despite the ubiquity of affected Apple platforms.

Technical ContextAI

CWE-415 (Double Free) describes a condition where a program frees the same memory region twice, corrupting the heap allocator's internal state. In the context of Apple's web content processing stack - almost certainly WebKit, the engine used across all Apple platforms - a specially crafted HTML, JavaScript, or media payload can trigger this condition during parsing or rendering. The affected CPEs (cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos) cover all versions below 26.5.2 on both mobile and desktop. Heap corruption from a double free can in principle escalate to arbitrary code execution, but Apple's own CVSS scoring caps impact at A:H with C:N/I:N, suggesting internal analysis concluded the bug reliably produces a crash rather than controlled memory writes under current mitigations (PAC, heap hardening, sandbox isolation on Apple platforms).

RemediationAI

Update to iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 immediately via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). Vendor-released patches are confirmed per Apple's advisories at https://support.apple.com/en-us/127594 (iOS/iPadOS) and https://support.apple.com/en-us/127595 (macOS). For environments where immediate patching is not possible, limiting user exposure to untrusted web content - for example, restricting use of Safari and WebKit-based browsers to trusted sites, or enabling Lockdown Mode on iOS which restricts certain web features - reduces the attack surface, though these measures impact usability and do not eliminate risk on unpatched devices.