Skip to main content

Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS EUVDEUVD-2026-29251

| CVE-2026-28942 MEDIUM
Use After Free (CWE-416)
2026-05-11 apple GHSA-2m37-4h9f-8wcf
Denial Of Service Use After Free Memory Corruption Apple Tvos Visionos Watchos Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attacker creates malicious webpage
  2. Delivery
    Delivers webpage via email/link/ad
  3. Exploit
    Victim clicks link
  4. Install
    Safari parses malicious content
  5. C2
    Use-after-free triggered in memory manager
  6. Execute
    Safari process crashes
  7. Impact
    User denied service

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

User interaction is required-the malicious webpage must be opened in Safari via a link click, direct navigation, or automatic redirect. No unauthenticated network access without user action will trigger the vulnerability; Safari must process the crafted web content as the user browses. The vulnerability affects Safari on all Apple platforms in default configurations with no special security settings or optional features that increase or decrease risk. Exploitation is limited by the UI:R requirement and the constraint that the malicious content must be delivered over the network (AV:N) to Safari's rendering engine. Authentication is not required, and the attacker does not need credentials or elevated privileges.
Impact

The real-world risk is LOW to MODERATE despite the network attack vector. CVSS 6.5 with availability impact (denial of service) is elevated; however, EPSS of 0.01% (percentile 0%) strongly suggests minimal real-world exploitation probability, likely because: (1) the vulnerability causes only a crash, not code execution, reducing attacker motivation; (2) the UI:R requirement (user must interact with malicious content) adds friction; (3) no active exploitation is indicated by the absence of KEV status. The vulnerability is not in-the-wild exploited, and EPSS percentile 0% indicates this ranks among the lowest-risk vulnerabilities tracked by FIRST. No public exploit code is referenced. This is a classic high-CVSS-but-low-real-risk scenario: while the attack surface is broad (any Safari user), the impact is limited to DoS without persistence or data theft. Security teams should treat this as a standard patch cycle priority rather than an emergency, prioritizing only systems with high user-to-risk ratios (e.g., shared device environments, public-facing kiosks). The broad platform coverage (six Apple OSes) does increase patch management overhead.
Exploit ScenarioDerived

An attacker hosts a malicious webpage containing crafted HTML/JavaScript designed to trigger a use-after-free condition in Safari's memory manager. The attacker then tricks or socially engineers a victim into visiting the page (via email link, instant message, or advertisement). Upon loading, Safari crashes immediately, denying the user access to their browser session and cached tabs.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Safari on Apple platforms crashes when processing maliciously crafted web content due to a use-after-free vulnerability in memory management, resulting in denial of service. Affects iOS and iPadOS below 26.5, macOS Tahoe below 26.5, tvOS below 26.5, visionOS below 26.5, and watchOS below 26.5. Exploitation requires user interaction to visit a malicious webpage but does not allow code execution or information disclosure.

RemediationAI

Update to the latest security patch immediately: iOS and iPadOS 26.5 or later, macOS Tahoe 26.5 or later, tvOS 26.5 or later, visionOS 26.5 or later, and watchOS 26.5 or later. Patches are available via Settings > General > Software Update on iOS/iPadOS/watchOS devices, System Settings > General > Software Update on macOS, and the corresponding settings on tvOS and visionOS. As a temporary compensating control, restrict users' ability to visit untrusted websites or disable Safari on devices where alternative browsers are available; however, this is operationally restrictive and not recommended long-term. Prioritize patch deployment for shared devices, public kiosks, and high-risk user populations. No configuration changes or feature toggles mitigate this vulnerability-patching is the only effective remedy. Vendor advisory links are provided at https://support.apple.com/en-us/127110 (iOS/iPadOS), https://support.apple.com/en-us/127115 (macOS), https://support.apple.com/en-us/127118 (tvOS), https://support.apple.com/en-us/127119 (visionOS), and https://support.apple.com/en-us/127120 (watchOS).

Affected VersionsENISA

visionOS 0 <26.5
iOS and iPadOS 0 <26.5
watchOS 0 <26.5
macOS 0 <26.5
tvOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is a use-after-free (CWE-416) memory safety issue in Apple's Safari browser engine. Use-after-free bugs occur when a program references memory that has been previously freed, potentially causing the application to crash or behave unpredictably when attempting to access deallocated memory regions. In this case, the flaw exists in Safari's web content processing pipeline-likely in rendering, JavaScript execution, or DOM manipulation-where improper memory lifecycle management allows freed memory to be accessed. The vulnerability affects Safari's WebKit engine across all major Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), indicating the flaw is in shared core browser infrastructure. The CVSS vector AV:N/AC:L/PR:N/UI:R indicates the vulnerability requires network delivery of malicious content but needs user interaction (clicking a link, visiting a site).

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 13, 2026 - 16:22 NVD
6.5 (MEDIUM)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 nvd
MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Threat Intelligence Overview

EPSS Score
0.0%
Top 100% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28942 ADVISORY https://vuldb.com/vuln/362815 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28942 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483963 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28942.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy