Skip to main content

Apple Safari CVE-2026-43731

| EUVDEUVD-2026-40204 HIGH
Use After Free (CWE-416)
2026-06-29 apple GHSA-mrq3-x9xw-5cqm
Buffer Overflow Use After Free Memory Corruption Apple Ios And Ipados
8.8
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious web page
  2. Delivery
    Deliver crafted HTML/JavaScript to WebKit
  3. Exploit
    Trigger use-after-free in renderer
  4. Execution
    Corrupt renderer process memory
  5. Impact
    Execute attacker-controlled code in content process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to process attacker-controlled web content - i.e., visit a malicious or compromised web page, or load attacker-supplied HTML inside an app's WebKit-based WebView - on an unpatched Safari/iOS/iPadOS/macOS build older than 26.5.2. The single limiting factor is required user interaction (CVSS UI:R): the attack cannot fire without the user navigating to or opening the malicious content; no authentication is needed (PR:N) and default browser configurations are vulnerable. There is no networking, privilege, or special feature-flag prerequisite beyond rendering the crafted content with an affected, unpatched WebKit engine.
Impact

Signals are largely consistent and point to a genuinely high-priority browser bug, though not yet an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a network-reachable, low-complexity, unauthenticated attack gated only by user interaction - the victim must visit or be lured to malicious content - with high confidentiality, integrity, and availability impact in an unchanged scope (S:U), meaning the immediate impact is contained to the WebKit renderer process rather than a full system compromise on its own. There is no EPSS score provided in the input, so quantitative exploitation probability cannot be stated. The vulnerability is not in CISA KEV and no POC is referenced, so it is not confirmed actively exploited and no public exploit is identified at time of analysis. WebKit use-after-free bugs are historically attractive to commercial spyware and exploit chains, so despite the absence of public exploitation, patching should be prioritized given the ubiquity of the affected platforms. Self-reported by Apple, which suggests internal discovery rather than in-the-wild detection, but this is inferred from the 'Reported by: apple' field and not independently confirmed.
Exploit ScenarioDerived

An attacker hosts a malicious web page containing crafted HTML and JavaScript designed to trigger the WebKit use-after-free, then lures a victim into visiting it via phishing, a malicious ad, or a compromised site. When the victim's unpatched Safari or in-app WebView renders the content, the dangling pointer is reused, corrupting renderer memory and giving the attacker a foothold to attempt arbitrary code execution in the content process. No POC is referenced in the available data; the attack is low-complexity but requires the user to open the content (UI:R).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Memory corruption via use-after-free in Apple's WebKit browser engine allows remote attackers to corrupt memory when a victim processes maliciously crafted web content on Safari, iOS/iPadOS, or macOS prior to 26.5.2. The CVSS 3.1 score of 8.8 reflects network-reachable exploitation requiring only that a user open a malicious page; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation typically serves as the initial stage of a browser-based attack chain (often paired with a sandbox escape) to achieve code execution in the renderer.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which Apple states fix the issue via improved memory management; consult Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 for exact build numbers per platform. Because exploitation requires processing malicious web content, interim compromising controls include disabling JavaScript for untrusted sites (which breaks most modern web applications), enabling Lockdown Mode on iOS/iPadOS/macOS for high-risk users (which restricts web technologies and some media handling at the cost of reduced functionality), and using web/DNS filtering or enterprise MDM web-content restrictions to limit exposure to untrusted sites. These workarounds reduce but do not eliminate risk and degrade usability, so prompt installation of 26.5.2 is the only complete remediation.

Affected VersionsENISA

iOS and iPadOS 0 <26.5.2
Safari 0 <26.5.2
macOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2
euvd macos fix: 26.5.2
euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw is a CWE-416 use-after-free in the web content rendering stack shared across Apple platforms - Safari's WebKit engine, which also backs the system WebView on iOS and iPadOS and underpins web content processing on macOS. A use-after-free occurs when memory is freed but a dangling pointer continues to reference it; subsequent reuse of that memory allows an attacker who controls heap layout (via crafted HTML/JavaScript/DOM manipulation) to coerce the engine into operating on attacker-influenced data, leading to memory corruption. The CPE data (cpe:2.3:a:apple:safari, apple:ios_and_ipados, apple:macos) confirms the same underlying WebKit defect spans all three product lines, which is why Apple shipped coordinated 26.5.2 fixes. Apple states the issue was addressed with improved memory management.

Know when Ios And Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Remote crafted web content (AV:N/AC:L/PR:N) requires the user to open the page (UI:R); memory corruption in the renderer yields high C/I/A within an unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 29, 2026 - 22:22 NVD
8.8 (HIGH)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 29, 2026 - 19:43 cve.org
HIGH 8.8

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption.

Executive ViewAI

Why It Matters

A critical use-after-free vulnerability in Apple's WebKit browser engine affects Safari on macOS, iOS, and iPadOS, enabling remote memory corruption and potential code execution when users access maliciously crafted web content. This vulnerability impacts millions of employees and enterprise devices worldwide, representing a direct and easily exploitable attack vector requiring no specialized user action beyond routine web browsing. The threat is significant given the pervasiveness of Apple devices in corporate environments and the typical role of such browser vulnerabilities in initiating multi-stage attack chains targeting organizational assets.

Business Impact: High
Compensating Controls

Vendor-released patch: macOS/iOS/iPadOS 26.5.2 and later. Interim mitigations during remediation: restrict web access to pre-approved business sites, disable JavaScript in lower-trust browsing contexts, implement network-level filtering for known malicious content, and enable endpoint detection for anomalous renderer process behavior.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
Ubiquitous
WebKit underpins Safari and all iOS/iPadOS web rendering across billions of Apple devices
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Ios And Ipados

View all
CVE-2026-86950 HIGH POC
8.8 Sep 28

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-28952 HIGH POC
7.5 May 11

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-84561 CRITICAL
9.8 Sep 14

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43731 ADVISORY https://vuldb.com/vuln/374751 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy