Skip to main content

Visionos EUVDEUVD-2026-15050

| CVE-2026-20664 MEDIUM
Out-of-bounds Write (CWE-787)
2026-03-25 apple
Buffer Overflow Memory Corruption Apple Visionos Ios And Ipados
4.3
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
SUSE
MEDIUM
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
EUVD ID Assigned
Mar 25, 2026 - 01:00 euvd
EUVD-2026-15050
Analysis Generated
Mar 25, 2026 - 01:00 vuln.today
CVE Published
Mar 25, 2026 - 00:32 nvd
MEDIUM 4.3

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Memory corruption in Apple Safari, iOS, iPadOS, macOS, and visionOS allows remote attackers to crash affected processes by delivering maliciously crafted web content to users. The vulnerability requires user interaction to view the malicious content and does not enable code execution or information disclosure. A patch is currently unavailable for this issue.

Technical ContextAI

The vulnerability resides in Apple's WebKit rendering engine, which powers Safari (cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*) and is embedded in iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), macOS (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), and visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*). The root cause, though not explicitly mapped to a CWE identifier in the disclosed data, involves improper memory handling during the processing of web content—a class of defect typically associated with memory corruption flaws such as heap buffer overflows or use-after-free conditions. The fix specifically addresses memory handling improvements, suggesting the vulnerability could allow an attacker to trigger memory access violations that crash the rendering or JavaScript execution process without requiring special user privileges or interaction beyond viewing malicious content.

RemediationAI

Immediately upgrade to Safari 26.4 or later, iOS 26.4 or later, iPadOS 26.4 or later, macOS Tahoe 26.4 or later, and visionOS 26.4 or later according to your device portfolio. Consult Apple's official security advisories at https://support.apple.com/en-us/126792, https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126799, and https://support.apple.com/en-us/126800 for platform-specific update instructions. Until patching is completed, enforce web content filtering to restrict access to known malicious sites, disable JavaScript execution for untrusted content where operationally feasible, and educate users to avoid clicking suspicious links. Organizations managing Apple devices at scale should coordinate updates through mobile device management (MDM) platforms to ensure comprehensive coverage and validate successful remediation across all endpoints.

More in Visionos

View all
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2024-44309 MEDIUM
6.3 Nov 20

A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
CVE-2024-27815 HIGH
7.8 Jun 10

An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2024-54534 CRITICAL
9.8 Dec 12

The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2025-43342 CRITICAL
9.8 Sep 15

A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-15050 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy