EUVD-2026-40208
GHSA-g38x-fqx6-c9wx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted web page
-
DeliveryVictim navigates to malicious URL
-
ExploitWebKit parses crafted content
-
ExecutionDouble free triggered in memory allocator
-
ImpactWebContent process crashes unexpectedly
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | The victim must actively process maliciously crafted web content - for example, by navigating to an attacker-controlled URL in Safari or any app using WebKit for rendering. This is confirmed by UI:R in the CVSS vector. No authentication or special account privileges are required on the attacker's side (PR:N). No non-default configuration is needed; any unpatched device that can load web content is susceptible. Exploitation is limited to causing a process crash (denial of service); the CVSS C:N/I:N metrics confirm that data exfiltration or persistent compromise is not a confirmed outcome. Apple platform mitigations (sandboxed WebContent process, Pointer Authentication Codes) further limit blast radius beyond a crash, making reliable escalation to code execution unlikely without additional vulnerability chaining. |
| Impact | The CVSS 6.5 medium score reflects a realistic but bounded threat: network-reachable (AV:N), low complexity (AC:L), no privileges needed (PR:N), but user interaction is required (UI:R), and scope is unchanged (S:U) with no confidentiality or integrity impact. This combination means the worst confirmed outcome is an unexpected process crash - a denial-of-service against the web rendering process, not a full device compromise. EPSS data was not provided, but given the absence of KEV listing and public exploit code, real-world exploitation pressure appears low at time of analysis. The double free class (CWE-415) carries theoretical RCE potential on unmitigated systems, but Apple's layered mitigations (Pointer Authentication Codes, sandboxed WebContent process, hardened allocators) substantially raise the bar for weaponization beyond a crash. No conflict between CVSS signals and description text is noted - both consistently indicate availability-only impact requiring user interaction. |
| Exploit ScenarioDerived | An attacker hosts a maliciously crafted webpage containing content designed to trigger the double free in Apple's web content processing engine. A victim on an unpatched iOS, iPadOS, or macOS device visits the page (or is redirected to it via phishing), causing the WebContent process to crash unexpectedly and the browser or app to terminate. No public proof-of-concept code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Double free memory corruption in Apple's web content processing engine crashes the rendering process on iOS/iPadOS (pre-26.5.2) and macOS Tahoe (pre-26.5.2) when a device processes attacker-controlled web content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network delivery with no authentication required, though a user must interact with the malicious content, and impact is limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in a lower active-risk tier despite the ubiquity of affected Apple platforms.
RemediationAI
Update to iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 immediately via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). Vendor-released patches are confirmed per Apple's advisories at https://support.apple.com/en-us/127594 (iOS/iPadOS) and https://support.apple.com/en-us/127595 (macOS). For environments where immediate patching is not possible, limiting user exposure to untrusted web content - for example, restricting use of Safari and WebKit-based browsers to trusted sites, or enabling Lockdown Mode on iOS which restricts certain web features - reduces the attack surface, though these measures impact usability and do not eliminate risk on unpatched devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-415 (Double Free) describes a condition where a program frees the same memory region twice, corrupting the heap allocator's internal state. In the context of Apple's web content processing stack - almost certainly WebKit, the engine used across all Apple platforms - a specially crafted HTML, JavaScript, or media payload can trigger this condition during parsing or rendering. The affected CPEs (cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos) cover all versions below 26.5.2 on both mobile and desktop. Heap corruption from a double free can in principle escalate to arbitrary code execution, but Apple's own CVSS scoring caps impact at A:H with C:N/I:N, suggesting internal analysis concluded the bug reliably produces a crash rather than controlled memory writes under current mitigations (PAC, heap hardening, sandbox isolation on Apple platforms).
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Web content delivery is network-based requiring no privileges; user must visit the page (UI:R); only a process crash results, so C:N/I:N and A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB