iOS and iPadOS CVE-2026-64787

|

EUVD

EUVD-2026-60495 MEDIUM

Use After Free (CWE-416)

2026-08-17 apple

GHSA-p984-67jc-vc4w

Information Disclosure Use After Free Memory Corruption Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker hosts crafted malicious webpage
Delivery

Victim navigates to malicious URL
Exploit

WebKit processes crafted web content
Execution

Use-after-free triggered in memory manager
Impact

Browser process terminates unexpectedly

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	User interaction is required: the target must actively visit or be redirected to a webpage hosting maliciously crafted web content; there is no drive-by vector absent any user-initiated navigation. Exploitation is constrained to the WebKit process sandbox - impact is process termination only (availability), not arbitrary code execution or data access based on current vendor and CVSS data. No authentication is required on the attacker's side (PR:N), but the attack cannot proceed without the victim's browser loading the attacker-controlled content (UI:R). No special configuration or non-default settings are required on the victim device - any unpatched iOS/iPadOS device running a WebKit-based browser or macOS Tahoe system running Safari is within scope. The limiting factors are: mandatory user interaction (single-click visit), impact bounded to DoS rather than compromise, and no confirmed exploitation in the wild.
Impact	The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects a remotely exploitable but user-interaction-dependent DoS with no data exfiltration risk. The attack vector is network-based with low complexity and no privileges required - a low-friction target - but user interaction (visiting a malicious page) is mandatory, meaningfully reducing mass exploitation risk. Scope is unchanged (S:U), meaning impact is contained to the crashing process rather than the broader OS. There is no CISA KEV listing and no known public proof-of-concept at time of analysis, and the EPSS data is not provided, so exploitation likelihood cannot be quantified further. A notable discrepancy exists: the intelligence tags include 'Information Disclosure,' but the CVSS vector confirms C:N and the vendor description specifies only process termination - these signals conflict and the CVSS/vendor description should be treated as authoritative until further clarified. Real-world priority is moderate: the impact is a browser crash rather than compromise, but the ubiquitous Apple device install base and trivial delivery mechanism (any webpage) justify prompt patching, particularly for users in sensitive operational environments.
Exploit ScenarioDerived	An attacker hosts a webpage containing maliciously crafted HTML, JavaScript, or media content designed to trigger the use-after-free condition in WebKit's memory management. A user on an unpatched iPhone, iPad, or Mac visits the page - via phishing email, malicious ad network, or compromised site - causing Safari or another WebKit-based app to process the content, trigger the UAF, and crash the browser process abruptly. No public proof-of-concept exploit is identified at time of analysis, so the scenario currently represents theoretical reachability rather than confirmed weaponized delivery.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Aug 18, 2026

Unexpected process termination in Apple iOS/iPadOS and macOS Tahoe can be triggered remotely by luring a user to visit maliciously crafted web content, exploiting a use-after-free flaw in the web content rendering engine. The vulnerability affects iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with impact limited to availability - crashing the affected browser or WebKit-based process - and no confirmed confidentiality or integrity loss. No public exploit code or CISA KEV listing is identified at time of analysis, though the low-complexity, network-accessible attack surface warrants prompt patching given the broad Apple device install base.

RemediationAI

Update iOS and iPadOS to version 26.6.1 or later and macOS Tahoe to version 26.6.2 or later, per Apple security advisories at https://support.apple.com/en-us/148281 and https://support.apple.com/en-us/148282. These updates are available via standard Apple software update mechanisms (Settings > General > Software Update on iOS/iPadOS; System Settings > General > Software Update on macOS). If immediate updating is not possible, the most actionable compensating control is to restrict exposure to untrusted web content: disable JavaScript in Safari (Settings > Apps > Safari > Advanced) or use a locked-down browser profile for untrusted browsing, though this significantly degrades web functionality. Restricting use of WebKit-based browsers entirely on managed devices is another option with full mitigation value but high usability trade-off. Mobile Device Management (MDM) deployments should push the update via supervised update policies without waiting for user action.

Affected VersionsENISA

macOS 0 <26.6.2

iOS and iPadOS 0 <26.6.1

Affected Packages

euvd ios_and_ipados fix: 26.6.1

euvd macos fix: 26.6.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability is classified as CWE-416 (Use-After-Free), a memory corruption class where a pointer to freed heap memory is subsequently dereferenced, corrupting the heap state. In Apple platforms, web content processing is handled by WebKit, the engine underpinning Safari and all third-party iOS browsers (per Apple's platform policy). A use-after-free in this layer means crafted web content - likely via JavaScript, HTML parsing, or media element handling - can manipulate memory allocation and deallocation sequencing such that a freed object is accessed again, leading to a crash. CPE strings confirm affected products as cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* (all versions before 26.6.1) and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* (all versions of Tahoe before 26.6.2). While UAF flaws can theoretically lead to code execution, Apple's vendor description and the CVSS impact metrics (C:N/I:N/A:H) indicate only a denial-of-service outcome - process termination - was confirmed for this specific bug.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network-delivered via web content, low complexity, no attacker privileges; user must visit page (UI:R); only availability impacted (process crash), no C or I.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Aug 18, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Aug 17, 2026 - 22:03 EUVD

CVE Published

Aug 17, 2026 - 21:30 cve.org

MEDIUM 6.5

CVE Published

Aug 17, 2026 - 21:30 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process termination.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Ubiquitous

billions of iOS, iPadOS, and macOS devices deployed globally

Social Media

1

Sightings

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

CVE-2026-84609 CRITICAL Act Now

A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvO

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2025-68613 HIGH POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://access.redhat.com/errata/RHSA-2026:54572 ADVISORY https://access.redhat.com/errata/RHSA-2026:54634 ADVISORY https://access.redhat.com/errata/RHSA-2026:57348 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64787 ADVISORY https://seclists.org/oss-sec/2026/q3/521 ADVISORY https://vuldb.com/vuln/391480 REF https://support.apple.com/en-us/148281 REF https://support.apple.com/en-us/148282 REF https://support.apple.com/en-us/148286 REF https://support.apple.com/en-us/148287 REF https://support.apple.com/en-us/149036 REF https://support.apple.com/en-us/149037 REF https://support.apple.com/en-us/149038

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy