What is the CVSS score of CVE-2026-43709?

CVE-2026-43709 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43709?

Yes, a patch is available for CVE-2026-43709. Update the affected software to the latest version immediately.

Apple WebKit CVE-2026-43709

EUVD-2026-40195 MEDIUM

Use After Free (CWE-416)

2026-06-29 apple

GHSA-c3mv-5qhf-r357

Memory Corruption Apple Denial Of Service Use After Free Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-delivered via malicious web page (AV:N/AC:L/PR:N/UI:R); impact confirmed as crash-only with no confidentiality or integrity consequence (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:36 vuln.today

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Use-after-free memory corruption in Apple's WebKit engine causes unexpected process crashes when processing maliciously crafted web content. Affected platforms include Safari, iOS 26, iPadOS 26, and macOS Tahoe - all versions prior to 26.5.2. An unauthenticated remote attacker can trigger a denial-of-service condition by luring a user to a malicious web page; no public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory safety flaw where a pointer to a freed memory region is dereferenced after the allocator has reclaimed it, resulting in memory corruption. WebKit is Apple's open-source browser rendering engine embedded in Safari and - by platform policy - every third-party browser on iOS and iPadOS. The vulnerability resides in the web content processing layer (likely the JavaScript engine, DOM parser, or media pipeline), which handles attacker-controlled input from the network. CPE strings cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, and cpe:2.3:a:apple:macos confirm the flaw manifests across all three Apple product lines that embed WebKit. Apple's advisory language ('addressed with improved memory management') is consistent with inserting explicit lifecycle guards or refactoring ownership semantics in the affected subsystem.

RemediationAI

Vendor-released patch: Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2. Update iOS and iPadOS via Settings > General > Software Update; update macOS via System Settings > Software Update; update Safari on macOS via the Mac App Store. Full vendor advisories are available at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. As a compensating control prior to patching, disabling JavaScript in Safari (Settings > Safari > Advanced > JavaScript) will significantly reduce WebKit's attack surface but will break the majority of modern web applications, making this impractical in most environments. Enterprise MDM administrators can restrict Safari to approved domains via Content Filter payloads, reducing exposure to attacker-controlled web content without disabling browsing entirely.