EUVD-2026-60501
GHSA-23mg-c4fv-vfxj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Web content delivery is network-borne with no privileges needed, user must actively visit the page, and memory corruption yields only partial C/I impact with no availability or scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.
AnalysisAI
Memory corruption in Apple's web content processing stack affects iOS and iPadOS prior to version 26.6.1 and macOS Tahoe prior to 26.6.2, triggered when a user processes maliciously crafted web content. Classified under CWE-119 (improper bounds restriction), the flaw carries a CVSS 5.4 medium rating reflecting limited confidentiality and integrity impact without availability disruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user on a vulnerable Apple device - iOS or iPadOS prior to 26.6.1, or macOS Tahoe prior to 26.6.2 - to actively process maliciously crafted web content, meaning the victim must navigate to or load attacker-supplied content in a WebKit-based browser or in-app web view (UI:R is required; passive drive-by without any user action is not sufficient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 medium score is internally consistent: while the attack vector is network-reachable (AV:N) with no privilege requirement (PR:N) and low complexity (AC:L), the mandatory user interaction (UI:R) and limited impact ceiling (C:L/I:L, A:N, S:U) constrain real-world exploitability considerably. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update to iOS 26.6.1 or iPadOS 26.6.1 on iPhone and iPad devices and to macOS Tahoe 26.6.2 on Mac systems, as confirmed by Apple's security advisories at https://support.apple.com/en-us/148281 and https://support.apple.com/en-us/148282. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today