Apple Safari CVE-2026-64782

The victim must actively process maliciously crafted web content in Safari on a vulnerable Apple device - this is the UI:R requirement confirmed by the CVSS vector. The AC:H rating reflects the inherent difficulty of winning a race condition: the attacker must engineer the web content so that concurrent execution paths collide within a narrow timing window, which is not reliably reproducible without device-specific tuning. No authentication or prior account access is required (PR:N), and the attack is delivered remotely over the network (AV:N). Exploitation is limited to: devices running iOS/iPadOS below 18.7.10 or 26.6.1, or macOS Tahoe below 26.6.2; user willingness to visit an attacker-controlled or compromised web page; and the attacker's ability to consistently win the race condition. The impact is bounded to an availability disruption (Safari crash) with no confidentiality or integrity consequence confirmed by current data.

The CVSS 3.1 base score of 3.1 (Low) accurately represents the bounded real-world impact: exploitation demands AC:H (timing-sensitive race condition execution), UI:R (victim must actively process crafted web content), and yields only A:L (Safari crash - not system crash, not code execution). There is no confidentiality or integrity impact (C:N/I:N). No EPSS data was provided in the intelligence feed, and the vulnerability is absent from the CISA KEV catalog, meaning no confirmed active exploitation has been observed. Even a mid-sized municipal IT team in malbork managing a primarily Apple device fleet would reasonably schedule this update during the next standard patch cycle rather than invoking emergency change procedures. One signal worth monitoring: CWE-362 race conditions in WebKit have historically served as stepping stones toward more severe primitives in subsequent CVEs - if a follow-on advisory references this same component, the urgency calculus should be revisited. The discrepancy between the 'Buffer Overflow' tag from the intelligence feed and the CWE-362 classification should be verified against the full Apple security advisory; if both conditions are present, the actual impact ceiling could be higher than the current CVSS reflects.

An attacker hosts a maliciously crafted web page designed to trigger a race condition in Safari's memory management during page rendering or script execution. When a target user visits the page in Safari on an unpatched iOS, iPadOS, or macOS device, the race condition corrupts memory state and causes Safari to crash unexpectedly. No public exploit code has been identified, and AC:H indicates that reliably triggering the race condition requires precise timing, limiting the practicality of opportunistic attacks.