Apple WebKit EUVD-2026-40184

| CVE-2026-43742 MEDIUM

Use After Free (CWE-416)

2026-06-29 apple

GHSA-vjvw-hpgr-cw8j

Denial Of Service Use After Free Memory Corruption Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker hosts crafted webpage
Delivery

Victim visits malicious URL in Safari
Exploit

WebKit parses and renders crafted content
Execution

Use-after-free triggered in rendering pipeline
Impact

Browser process crashes unexpectedly

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The victim must visit a maliciously crafted webpage using Safari or a WebKit-based browser/WebView on an affected Apple platform running Safari prior to 26.5.2, iOS/iPadOS prior to 26.5.2, or macOS Tahoe prior to 26.5.2. User interaction is explicitly required (CVSS UI:R) - the target must navigate to attacker-controlled content; drive-by exploitation via passive network positioning is not indicated. No authentication, privileged account, or special configuration is required from the attacker's side (CVSS PR:N, AC:L). Exploitation is bounded to causing a process crash (denial of service); confirmed impact is limited to availability (CVSS C:N/I:N/A:H), with no confirmed code-execution path from current data.
Impact	The CVSS 3.1 score of 6.5 (Medium) is supported by the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: the attack is network-delivered with low complexity and no required privileges, but demands user interaction (visiting a malicious page) and yields only an availability impact - a process crash - with no confidentiality or integrity compromise. This impact profile (A:H only) significantly limits attacker utility compared to UAF bugs that enable code execution. No EPSS data was provided, so exploitation probability cannot be quantified independently. The absence of a CISA KEV listing and no reported POC code further reduces near-term risk. Real-world priority is moderate: this is a straightforward browser DoS, not a code-execution primitive. Organizations with high-sensitivity browser users (executives, privileged admin workstations using Safari) should prioritize patching, but this does not represent an emergency response scenario absent KEV confirmation.
Exploit ScenarioDerived	An attacker constructs a webpage embedding maliciously crafted HTML, CSS, or JavaScript designed to trigger a use-after-free condition in WebKit's memory management during content parsing or rendering. A target user on an unpatched Apple device visits the URL - via a phishing link, malicious ad, or compromised site - causing the Safari (or in-app WebView) process to crash unexpectedly. No public exploit code has been identified, making reliable weaponization at this time unconfirmed.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 29, 2026

Use-after-free memory corruption in Apple's WebKit rendering engine causes unexpected process crashes when processing maliciously crafted web content across Safari, iOS/iPadOS, and macOS Tahoe. All three platform variants prior to the 26.5.2 release train are affected, covering a substantial portion of Apple's consumer and enterprise device fleet. An unauthenticated remote attacker can trigger a denial-of-service condition by enticing a victim to visit a specially crafted webpage; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

RemediationAI

The primary fix is to update to Safari 26.5.2, iOS and iPadOS 26.5.2, or macOS Tahoe 26.5.2, all of which contain Apple's memory management correction for this flaw. Updates are available via the standard Apple Software Update mechanism. Vendor advisories are published at https://support.apple.com/en-us/127594 (Safari), https://support.apple.com/en-us/127595 (iOS/iPadOS), and https://support.apple.com/en-us/127685 (macOS Tahoe). As a compensating control where immediate patching is not possible, consider restricting Safari usage via mobile device management (MDM) profiles to block access to untrusted or external URLs, though this trade-off degrades browser functionality. Enabling Content Security Policy headers on internally hosted web properties does not mitigate client-side rendering bugs of this type.

Affected VersionsENISA

Safari 0 <26.5.2

iOS and iPadOS 0 <26.5.2

macOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

CWE-416 (Use After Free) describes a condition where a program continues referencing memory after it has been freed, leading to undefined behavior - commonly a crash, but potentially exploitable for code execution depending on heap layout. In WebKit, the shared browser rendering engine underlying Safari and all iOS/iPadOS WebViews, UAF bugs frequently arise in DOM lifecycle management, JavaScript engine object handling, or CSS rendering pipelines. The affected CPE strings (cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirm the shared WebKit codebase as the root component across all three platform variants. Apple's advisory language - 'addressed with improved memory management' - is consistent with introducing stronger object lifetime tracking or ownership checks to prevent the dangling pointer dereference.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Attack is network-delivered via crafted web content (AV:N, AC:L), requires no attacker privileges (PR:N), demands user page visit (UI:R), and results only in a process crash with no confidentiality or integrity impact (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Threat Intelligence Overview

EPSS Score

0.2%

Top 84% exploitable

Prevalence

High

Safari is the default browser across Apple's large consumer and enterprise device base

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Denial Of Service

View all

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43742 ADVISORY https://vuldb.com/vuln/374757 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy