iOS and iPadOS CVE-2026-65341

Exploitation requires that the victim actively processes maliciously crafted web content - for example, visiting an attacker-controlled webpage in Safari or any WebKit-based browser on iOS/iPadOS, or processing embedded web content in macOS applications. The CVSS UI:R metric confirms that user interaction (opening or rendering the content) is mandatory; passive network presence is insufficient. No authentication is required on the attacker's side (PR:N), and no complex attack setup is needed (AC:L). Exploitation is limited to unpatched versions: iOS/iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2. The S:U (unchanged scope) metric indicates the impact is contained within the browser or application processing the content and does not directly pivot to the underlying OS in the assessed scenario.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) scores 5.4 Medium. The network attack vector with no privilege requirement is concerning, but the mandatory user interaction (UI:R) is a meaningful barrier: exploitation requires a victim to actively visit or load attacker-controlled web content. The C:L/I:L impact metrics suggest the vendor assessed exploitation as unlikely to yield full RCE - partial confidentiality and integrity impact aligns with memory disclosure or limited corruption scenarios rather than arbitrary code execution, though buffer overflows carry inherent escalation risk. EPSS at 0.14% (4th percentile) strongly corroborates low near-term exploitation likelihood. No KEV listing and no reported POC further reduce urgency. The dual-branch fix (iOS 18.7.10 for legacy devices and iOS 26.6.1 for current) suggests Apple assessed this as sufficiently serious to backport, adding weight to the real-world applicability of the flaw. Overall: medium-priority patch cycle candidate, not an emergency - unless deployment involves high-risk user populations (executives, journalists, high-value targets) where even partial memory exposure warrants faster action.

An attacker hosts a webpage containing maliciously crafted content - such as a manipulated image, media file, or JavaScript payload - designed to trigger an out-of-bounds memory operation in WebKit's content parser. A target user on an unpatched Apple device visits the URL (via a phishing link, malvertising, or embedded iframe), causing WebKit to process the content and corrupt memory, potentially leaking limited data or modifying application state. No public exploit identified at time of analysis, and the AC:L metric indicates no special delivery conditions are required beyond convincing the user to follow a link.