Apple Safari EUVD-2026-40183

| CVE-2026-43715 HIGH

Use After Free (CWE-416)

2026-06-29 apple

GHSA-rvhg-xh7h-fp5g

Buffer Overflow Use After Free Memory Corruption Apple Ios And Ipados

8.8

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious page
Delivery

Deliver crafted web content
Exploit

Trigger use-after-free in WebKit
Execution

Corrupt renderer process memory
Impact

Hijack control flow / impact CIA

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to load attacker-controlled web content in an unpatched WebKit instance (Safari or any app using the system WebView) on iOS/iPadOS/macOS before 26.5.2 - i.e., user interaction is mandatory (UI:R): the user must navigate to a malicious page or open content that auto-renders crafted HTML/JavaScript. No authentication or pre-existing privileges are needed (PR:N), and the attack is delivered remotely over the network (AV:N) with low complexity (AC:L). The principal limiting factor is the required user interaction and the need for the target to be on a version prior to 26.5.2; there is no special non-default configuration required, as web rendering is default behavior.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated bug whose only gating factor is user interaction - the victim must visit or be lured to a malicious page. This is a high but not maximal severity profile typical of browser-engine memory corruption. It is NOT in CISA KEV (no confirmed active exploitation) and no public exploit is identified, so EPSS-style real-world exploitation pressure should be treated as currently unproven rather than imminent. The description states only 'memory corruption' as the outcome, not confirmed arbitrary code execution; the C:H/I:H/A:H impacts are an inference consistent with WebKit UAF bugs that are commonly chained into RCE, but standalone this CVE does not assert sandbox escape or code execution. The fact that Apple self-reported (rather than a third party reporting in-the-wild abuse) suggests internal discovery rather than observed exploitation. Real priority: high for any fleet rendering untrusted web content, driven by ubiquity of the engine and ease of delivery, but tempered by the UI:R requirement and absence of a known exploit.
Exploit ScenarioDerived	An attacker hosts a malicious web page containing crafted content that triggers the use-after-free in WebKit and lures a target into visiting it via a phishing link, malicious ad, or compromised site. When the victim's unpatched Safari or WebView renders the page, the dangling pointer is dereferenced and process memory is corrupted, potentially giving the attacker control over the renderer. No public exploit code is identified at time of analysis, and the low attack complexity means a working exploit, once developed, would be reliable.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 29, 2026

Memory corruption in Apple's WebKit browser engine (Safari and the system WebView on iOS, iPadOS, and macOS before 26.5.2) allows a remote attacker to corrupt process memory when a victim loads maliciously crafted web content. The flaw is a use-after-free (CWE-416) and carries a CVSS 8.8 with required user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Apple reported and patched it in coordinated releases on 2026 advisories.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which contain the corrected memory management; this is the primary and recommended fix. Consult Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 for exact build numbers and device coverage. Because exploitation requires rendering malicious web content, an interim compensating control is to restrict browsing to trusted sites and deploy web/DNS filtering or a secure web gateway to block untrusted or unknown domains until devices are updated - the trade-off is reduced browsing flexibility and incomplete coverage against newly registered malicious domains. Disabling JavaScript in Safari would substantially reduce the attack surface for DOM/JS-driven UAF triggers but breaks the majority of modern websites and is generally impractical fleet-wide. There is no reliable workaround that preserves full functionality, so prompt patching is the correct course.

Affected VersionsENISA

Safari 0 <26.5.2

iOS and iPadOS 0 <26.5.2

macOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability resides in Apple's WebKit rendering engine, which underpins Safari and any application using the system WebView (WKWebView) on iOS, iPadOS, and macOS. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer during processing of crafted HTML/JavaScript/DOM content leads to memory corruption. The CPE set (cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos) confirms the bug spans the browser application and the OS-bundled web stack, meaning the attack surface is any code path that renders untrusted web content. Apple addressed it with improved memory management, the standard remediation for lifecycle/ownership defects in the engine.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Remote crafted web content (AV:N/AC:L/PR:N) requires the user to load the page (UI:R); a WebKit renderer UAF plausibly yields high C/I/A within the unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

4

CVSS changed

Jun 29, 2026 - 22:22 NVD

8.8 (HIGH)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

HIGH 8.8

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption.

Executive ViewAI

Why It Matters

Apple WebKit memory corruption (CVE-2026-43715) affecting Safari and system WebView on macOS, iOS, and iPadOS creates risk of unauthorized device access and data compromise when enterprise users visit malicious websites. With CVSS 8.8 and no mitigations other than patching, immediate vendor patch deployment across all Apple devices is critical to reduce breach risk.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Ubiquitous

WebKit/Safari ships on every iPhone, iPad, and Mac

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact

High

Technical Impact

Total

Priority Score

44

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43715 ADVISORY https://vuldb.com/vuln/374730 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/149041

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy