Apple Safari EUVD-2026-40188

The victim must actively process maliciously crafted web content in Safari - this corresponds to CVSS UI:R (required user interaction), meaning the victim must visit or open an attacker-controlled page or resource. No authentication is required from the attacker side (PR:N). No non-default configuration is needed; any default Safari installation across macOS Tahoe, iOS, and iPadOS prior to 26.5.2 is susceptible. Exploitation is limited by: (1) required user interaction - the victim must navigate to or open attacker-controlled web content; (2) impact is crash/DoS only - no code execution or data disclosure is described in the available data. The crash-only outcome and UI:R requirement together substantially reduce the utility of this vulnerability for targeted or persistent attacks.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) yields a Medium score of 6.5. The network attack vector and low complexity indicate drive-by delivery is technically feasible, but UI:R (user must visit or open malicious content) is a meaningful friction point that limits mass automated exploitation. Critically, the impact is strictly availability - C:N and I:N confirm no data exfiltration or code execution path is described; the consequence is a Safari crash. No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no POC code has been identified, further reducing urgency. Overall assessment: moderate real-world priority - patch promptly given the massive Apple device footprint, but the crash-only impact and user-interaction requirement prevent this from being an emergency for most environments absent active exploitation evidence.

An attacker hosts a web page containing specially crafted content designed to trigger the stack overflow in Safari's input parsing logic. A victim on an unpatched Apple device visits the page - via a phishing link, malvertising redirect, or embedded iframe - causing Safari to process the malicious content, exhaust the stack buffer, and crash. No public POC has been identified, but the network-delivery and low-complexity characteristics mean a working exploit would require only a hosting server and a convincing lure.