Skip to main content

Apple Safari CVE-2026-43740

| EUVDEUVD-2026-40212 MEDIUM
Buffer Overflow (CWE-119)
2026-06-29 apple GHSA-xxx6-g6jv-xq96
Buffer Overflow Apple Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts maliciously crafted webpage
  2. Delivery
    Victim navigates to page in unpatched Safari/WebKit
  3. Exploit
    Malformed content triggers CWE-119 buffer boundary violation in WebKit
  4. Execution
    Browser process memory contents disclosed to attacker
  5. Impact
    Attacker harvests tokens or memory layout data

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target user navigate to or render attacker-controlled web content using an unpatched version of Safari, iOS/iPadOS (before 26.5.2), or macOS Tahoe (before 26.5.2). The CVSS UI:R metric confirms user interaction is necessary - the victim must actively visit or be redirected to the malicious content; drive-by exploitation without any user gesture is not indicated. No authentication is required (PR:N), and attack complexity is low (AC:L), meaning no race conditions or special target configurations are needed. Exploitation is limited to the WebKit-based browser process; it does not directly affect the kernel or other applications. Non-Apple browsers (Chrome, Firefox) on macOS are not subject to this vulnerability as they do not use WebKit. iOS restricts all third-party browsers to the WebKit engine, meaning all iOS browsers are exposed regardless of brand.
Impact

The CVSS 6.5 Medium score is driven by UI:R (user interaction required) and S:U (no scope change), which cap the base score despite PR:N and C:H. In practice, the UI:R barrier is minimal - an attacker need only host a malicious page and induce a single navigation, which is trivially achieved via phishing, malvertising, or iframe injection. The C:H impact is significant: process memory disclosure in a browser process routinely yields authentication tokens, sensitive page content, or heap layout information useful for ASLR bypass in chained exploits. No EPSS score was included in the available data, so exploitation probability cannot be quantified numerically. No CISA KEV listing and no public POC have been identified, suggesting this is not yet subject to commodity exploitation. However, Apple's issuance of a rapid point-release (26.5.2) across Safari, iOS/iPadOS, and macOS simultaneously signals internal urgency. The primary risk today is targeted or opportunistic exploitation before patch adoption, particularly on iOS where users may not update promptly. The absence of integrity or availability impact (I:N/A:N) limits direct damage but does not diminish the value of memory leakage as a reconnaissance primitive in multi-stage attacks.
Exploit ScenarioDerived

An attacker crafts a malicious webpage embedding specially formed HTML, CSS, or JavaScript content designed to trigger the CWE-119 buffer boundary violation in WebKit's content processing pipeline. When an unpatched Safari or iOS/iPadOS user visits the page - via a phishing link, malicious advertisement, or compromised legitimate site embedding an iframe - the browser engine processes the content and leaks regions of its own process memory back to the attacker, potentially exposing session cookies, authentication tokens, or sensitive page data. No public proof-of-concept is known at this time, but the attack requires no special privileges and only a single user navigation to trigger.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Safari, iOS/iPadOS, and macOS Tahoe expose process memory when the browser engine processes maliciously crafted web content, rooted in a CWE-119 improper memory buffer restriction (tagged Buffer Overflow). The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) indicates a network-reachable, low-complexity attack requiring only that the victim visit or render attacker-controlled content, resulting in high confidentiality impact through memory leakage. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis; Apple has released patched versions (26.5.2) across all affected platforms.

RemediationAI

The primary fix is to upgrade to the patched versions released by Apple: Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2. Updates are available through Software Update on macOS and Settings > General > Software Update on iOS/iPadOS. iOS and iPadOS users should prioritize this update given the platform's broad consumer exposure and typically slower enterprise patch cadence. For environments where immediate updates are not feasible, a compensating control is to restrict access to untrusted or external web content by enforcing content filtering at the network layer or configuring managed device policies to block untrusted browsing; however, this does not eliminate the attack surface for socially engineered or email-delivered links. No workaround eliminates the underlying memory handling flaw short of patching. Advisory references: https://support.apple.com/en-us/127594 (Safari), https://support.apple.com/en-us/127595 (iOS/iPadOS), https://support.apple.com/en-us/127685 (macOS).

Affected VersionsENISA

Safari 0 <26.5.2
iOS and iPadOS 0 <26.5.2
macOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2
euvd macos fix: 26.5.2
euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Apple's web content processing layer - almost certainly WebKit, the rendering engine shared across Safari, iOS/iPadOS WKWebView, and macOS. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates a failure to enforce buffer boundaries during content parsing or layout, permitting reads from regions of process memory that should be inaccessible to the web layer. This class of flaw in browser engines typically manifests in DOM parsing, JavaScript JIT compilation, or media/resource decoding pipelines. The affected CPE strings cover cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, and cpe:2.3:a:apple:macos across all versions prior to 26.5.2, confirming the shared WebKit codebase as the root locus. Memory disclosure bugs of this class can leak heap pointers, session tokens, cached credentials, or other process-resident sensitive data to attacker-controlled JavaScript or network responses.

Know when Ios And Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI 6.5 MEDIUM

Network-reachable via web content with no privileges; UI:R because a page visit is required; C:H for process memory disclosure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
Jun 29, 2026 - 22:22 NVD
6.5 (MEDIUM)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 29, 2026 - 19:43 cve.org
MEDIUM 6.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may result in the disclosure of process memory.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
High
Default browser on billions of iOS, iPadOS, and macOS devices globally
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Ios And Ipados

View all
CVE-2026-86950 HIGH POC
8.8 Sep 28

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-28952 HIGH POC
7.5 May 11

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-84561 CRITICAL
9.8 Sep 14

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43740 ADVISORY https://vuldb.com/vuln/374741 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128066 REF https://support.apple.com/en-us/128067 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/128073

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy