Skip to main content

Visionos EUVDEUVD-2026-15050

| CVE-2026-20664 MEDIUM
Out-of-bounds Write (CWE-787)
2026-03-25 apple
Buffer Overflow Memory Corruption Apple Visionos Ios And Ipados
4.3
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-787
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This vulnerability presents a moderate-to-high real-world priority despite the absence of a CVSS score and EPSS probability estimate. The attack vector is network-based (maliciously crafted web content), complexity is low (requires only that a user visit or be redirected to a malicious website), and no special privileges are required. The technical impact is limited to denial of service (process crash) rather than data exfiltration or code execution, which lowers severity compared to memory corruption vulnerabilities that enable arbitrary execution. The breadth of affected platforms (five major Apple OS families) and the fact that Apple released coordinated patches across all affected versions (indicated by the four distinct support article references) signal that Apple assessed this as sufficiently critical to warrant simultaneous remediation across its entire ecosystem. The absence of a public proof-of-concept and KEV listing suggests the vulnerability is not yet widely exploited in the wild, but the denial-of-service nature and ease of delivery via web content make it a practical attack vector for disruption campaigns. Organizations should prioritize patching based on user exposure to untrusted web content rather than waiting for higher exploit signals.
Exploit ScenarioDerived

An attacker crafts a malicious webpage containing specially formatted HTML, CSS, or JavaScript that triggers a memory handling error in WebKit when parsed or rendered. When a user visits the malicious site via Safari or a web browser on iOS, iPadOS, macOS, or visionOS, the rendering engine encounters the crafted content, improperly manages memory, and crashes the browser or WebKit process. The user experiences a sudden application termination; depending on the context, this could interrupt productivity, disrupt services that rely on background web processing, or be weaponized at scale against organizations via malvertising networks or compromised legitimate websites to achieve widespread denial of service. No special user interaction beyond visiting a website is required; phishing or social engineering could increase the likelihood of users reaching the malicious content.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

Memory corruption in Apple Safari, iOS, iPadOS, macOS, and visionOS allows remote attackers to crash affected processes by delivering maliciously crafted web content to users. The vulnerability requires user interaction to view the malicious content and does not enable code execution or information disclosure. A patch is currently unavailable for this issue.

Earlier versions of this analysis (1)
v1 Mar 25, 2026 - 01:00 CVSS 4.3

A memory handling vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, and visionOS, allowing attackers to crash affected processes by processing maliciously crafted web content. This denial-of-service vulnerability impacts all versions prior to Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4. While no CVSS score, EPSS probability, or public proof-of-concept have been disclosed, the vulnerability's presence across multiple Apple platforms and the specificity of the memory handling fix indicates a moderate real-world risk requiring prompt patching.

RemediationAI

Immediately upgrade to Safari 26.4 or later, iOS 26.4 or later, iPadOS 26.4 or later, macOS Tahoe 26.4 or later, and visionOS 26.4 or later according to your device portfolio. Consult Apple's official security advisories at https://support.apple.com/en-us/126792, https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126799, and https://support.apple.com/en-us/126800 for platform-specific update instructions. Until patching is completed, enforce web content filtering to restrict access to known malicious sites, disable JavaScript execution for untrusted content where operationally feasible, and educate users to avoid clicking suspicious links. Organizations managing Apple devices at scale should coordinate updates through mobile device management (MDM) platforms to ensure comprehensive coverage and validate successful remediation across all endpoints.

Affected VersionsENISA

Safari 0 <26.4
iOS and iPadOS 0 <26.4
visionOS 0 <26.4
macOS 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4
euvd visionos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Apple's WebKit rendering engine, which powers Safari (cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*) and is embedded in iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), macOS (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), and visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*). The root cause, though not explicitly mapped to a CWE identifier in the disclosed data, involves improper memory handling during the processing of web content—a class of defect typically associated with memory corruption flaws such as heap buffer overflows or use-after-free conditions. The fix specifically addresses memory handling improvements, suggesting the vulnerability could allow an attacker to trigger memory access violations that crash the rendering or JavaScript execution process without requiring special user privileges or interaction beyond viewing malicious content.

Know when Visionos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
SUSE MEDIUM
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Mar 25, 2026 - 00:32 nvd
MEDIUM 4.3

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

Organizations using The should be aware of moderate risk from CVE-2026-20664, a out-of-bounds write vulnerability rated CVSS 4.3. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Related Vulnerabilities in macOS Tahoe 26.4 Security Updates

View all 67
CVE-2026-28839 MEDIUM
5.3
CVE-2026-28879 MEDIUM
6.5
CVE-2026-20695 MEDIUM
6.2
CVE-2026-28825 HIGH
7.1
CVE-2026-28844 MEDIUM
6.5
CVE-2026-20665 MEDIUM
6.5
CVE-2026-20668 MEDIUM
5.5
CVE-2026-28835 MEDIUM
6.5
CVE-2026-28841 MEDIUM
6.2
CVE-2026-28864 LOW
3.3
CVE-2026-20694 MEDIUM
5.5
CVE-2026-20607 MEDIUM
4.0
CVE-2026-20632 MEDIUM
5.3
CVE-2026-20637 MEDIUM
6.2
CVE-2026-20651 MEDIUM
6.2
CVE-2026-20686 MEDIUM
5.3
CVE-2026-20687 HIGH
7.1
CVE-2026-20688 CRITICAL
9.3
CVE-2026-20691 MEDIUM
4.3
CVE-2026-20692 MEDIUM
5.3
CVE-2026-20693 MEDIUM
4.9
CVE-2026-20698 HIGH
7.8
CVE-2026-20699 MEDIUM
6.2
CVE-2026-20701 HIGH
7.5
CVE-2026-28816 MEDIUM
4.0
CVE-2026-28818 MEDIUM
5.3
CVE-2026-28820 MEDIUM
5.3
CVE-2026-28821 HIGH
8.4
CVE-2026-28822 MEDIUM
6.2
CVE-2026-28823 MEDIUM
4.9
CVE-2026-28827 CRITICAL
9.3
CVE-2026-28828 MEDIUM
5.3
CVE-2026-28829 MEDIUM
5.5
CVE-2026-28831 MEDIUM
5.5
CVE-2026-28832 HIGH
8.4
CVE-2026-28837 HIGH
7.5
CVE-2026-28842 HIGH
7.5
CVE-2026-28852 MEDIUM
5.5
CVE-2026-28862 MEDIUM
5.3
CVE-2026-28865 HIGH
7.5
CVE-2026-28866 MEDIUM
6.2
CVE-2026-28868 MEDIUM
5.5
CVE-2026-28886 MEDIUM
5.9
CVE-2026-28892 MEDIUM
5.5
CVE-2026-28893 LOW
3.3
CVE-2026-28894 HIGH
7.5
CVE-2025-43534 MEDIUM
6.8
CVE-2026-20690 MEDIUM
6.5
CVE-2026-28824 MEDIUM
5.3
CVE-2026-28833 MEDIUM
6.2
CVE-2026-28834 MEDIUM
5.1
CVE-2026-20633 MEDIUM
5.5
CVE-2026-20631 HIGH
8.8
CVE-2026-28817 HIGH
8.1
CVE-2026-20639 HIGH
7.5
CVE-2026-28859 MEDIUM
4.3
CVE-2026-28861 MEDIUM
4.3
CVE-2026-20684 LOW
3.3
CVE-2026-28838 MEDIUM
5.3
CVE-2026-20657 MEDIUM
6.5
CVE-2026-28826 MEDIUM
4.0
CVE-2026-28877 MEDIUM
5.5
CVE-2026-28878 MEDIUM
6.5
CVE-2026-28882 MEDIUM
4.0
CVE-2026-20622 HIGH
7.5

More in Visionos

View all
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2024-44309 MEDIUM
6.3 Nov 20

A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
CVE-2025-43200 MEDIUM
4.2 Jun 16

A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
CVE-2025-43359 CRITICAL POC
9.8 Sep 15

A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2024-27815 HIGH
7.8 Jun 10

An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/352906 REF https://access.redhat.com/errata/RHSA-2026:10702 REF https://access.redhat.com/errata/RHSA-2026:11329 REF https://access.redhat.com/errata/RHSA-2026:11814 REF https://access.redhat.com/errata/RHSA-2026:13845 REF https://access.redhat.com/errata/RHSA-2026:14659 REF https://access.redhat.com/errata/RHSA-2026:16056 REF https://access.redhat.com/errata/RHSA-2026:16695 REF https://access.redhat.com/errata/RHSA-2026:19206 REF https://access.redhat.com/errata/RHSA-2026:19535 REF https://access.redhat.com/errata/RHSA-2026:22136 REF https://access.redhat.com/errata/RHSA-2026:9692 REF https://access.redhat.com/security/cve/CVE-2026-20664 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453001 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20664.json REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy