EUVD-2026-40213
GHSA-686m-qmpj-pqxf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:N/AC:L/PR:N because visiting a webpage is the only requirement; UI:R for mandatory victim interaction; A:H for confirmed crash with C:N/I:N as no data exfiltration or tampering is described.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
AnalysisAI
Use-after-free memory corruption in Safari's web content rendering engine causes an unexpected application crash when processing maliciously crafted web content. Affected are Apple Safari, iOS and iPadOS, and macOS Tahoe - all prior to version 26.5.2. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms that a remote unauthenticated attacker can trigger this condition simply by luring a user to visit a hostile page, with impact limited to availability (process crash/DoS). No public exploit code identified and not listed in CISA KEV at time of analysis; vendor-released patches are available.
Technical ContextAI
CWE-416 (Use-After-Free) describes a condition where a program continues to reference memory after it has been freed, leading to undefined behavior - typically a crash, but in more serious cases potentially code execution. The affected component is Apple's WebKit rendering engine, which underlies Safari on macOS as well as the mandatory browser engine for all iOS and iPadOS apps. CPE strings (cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos) confirm the vulnerability surface spans three separate platform releases that share the same underlying WebKit codebase. The flaw is triggered during parsing or rendering of specially crafted web content - a broad attack surface since virtually any website visit can supply arbitrary content to the engine.
RemediationAI
Vendor-released patches are available: update to Safari 26.5.2, iOS and iPadOS 26.5.2, and macOS Tahoe 26.5.2 as appropriate for the platform. Apple security advisories covering these fixes are at https://support.apple.com/en-us/127594 (Safari), https://support.apple.com/en-us/127595 (iOS/iPadOS), and https://support.apple.com/en-us/127685 (macOS). For environments where immediate patching is not possible, a compensating control is to restrict or disable Safari usage and require an alternative browser not based on WebKit (only viable on macOS; iOS/iPadOS mandates WebKit for all browsers). On managed iOS/iPadOS fleets, Mobile Device Management (MDM) profiles can restrict web browsing to allowlisted domains, reducing exposure to attacker-controlled content - though this has significant usability trade-offs. No workaround fully mitigates the risk on iOS/iPadOS without patching, given WebKit's mandatory use.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today