Apple Safari EUVD-2026-40189

| CVE-2026-43734 MEDIUM

Use After Free (CWE-416)

2026-06-29 apple

GHSA-44fm-8753-g4f8

Denial Of Service Use After Free Memory Corruption Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious web content
Delivery

Host on attacker-controlled page or inject via ad/phishing
Exploit

Lure victim to visit page
Execution

Trigger use-after-free in WebKit renderer
Impact

Process crash (DoS)

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to actively visit or be redirected to a maliciously crafted webpage, consistent with the CVSS UI:R (user interaction required) metric. No authentication, no special account privileges, and no non-default configuration are needed - the flaw is present in the default web content rendering pipeline. Exploitation is limited to: (1) the user must visit attacker-controlled or attacker-injected web content in Safari or a WKWebView-based application; (2) the outcome is a process crash (DoS), not code execution per the current description. The scope is unchanged (S:U), meaning the crash is contained to the Safari/browser process and does not directly propagate to the OS kernel or other processes.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 6.5 (Medium), reflecting a network-exploitable denial-of-service that requires only user interaction - no privileges, no special configuration. The impact is purely availability: the description confirms 'unexpected process crash' with no confidentiality or integrity consequence, limiting escalation potential from this vulnerability alone. No EPSS score was provided; CISA KEV is not listing this CVE, and no public proof-of-concept exploit has been identified. Real-world risk is moderate: the attack surface is enormous given Safari and WebKit's prevalence across Apple devices, and delivering a crash via a crafted webpage is trivially automatable via phishing or malvertising. However, the DoS-only impact substantially reduces attacker incentive compared to RCE variants. The absence of KEV and POC data, combined with a DoS-only impact, suggests this is a stability/reliability priority rather than an immediate exploitation emergency - though the large installed base warrants timely patching.
Exploit ScenarioDerived	An attacker creates a webpage containing specially crafted HTML, JavaScript, or media content that triggers a use-after-free condition in WebKit's memory management during parsing or rendering. The attacker hosts this page or injects it via an ad network or compromised site, then lures the target user to visit it - causing Safari or any WKWebView-based browser to crash. No POC is publicly available at time of analysis, but the pattern is consistent with well-understood WebKit exploit primitives.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 29, 2026

Use-after-free memory corruption in Safari's web content processing engine causes an unexpected process crash when rendering maliciously crafted web pages. Affected products include Safari, iOS and iPadOS, and macOS Tahoe, all prior to version 26.5.2. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the low attack complexity and no-privileges-required vector make user-targeted delivery straightforward.

RemediationAI

The primary fix is to update to the patched releases: Safari 26.5.2, iOS and iPadOS 26.5.2, or macOS Tahoe 26.5.2, available via Apple Software Update. Advisory references are https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. For iOS and iPadOS users, note that all browsers on those platforms rely on WebKit, so updating the OS is required - switching to an alternative browser does not provide a workaround. If immediate patching is not possible, a compensating control is to restrict access to untrusted web content using content filtering proxies or enterprise MDM web category blocking, though this introduces usability trade-offs. For macOS environments with strict patching cycles, disabling JavaScript or using a non-WebKit browser (Firefox, Chrome) for untrusted browsing can reduce exposure but does not address Safari itself.

Affected VersionsENISA

macOS 0 <26.5.2

Safari 0 <26.5.2

iOS and iPadOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

CWE-416 (Use After Free) describes a memory safety flaw where a program continues to reference a memory region after it has been freed, enabling memory corruption. In this case, the flaw resides in Safari's web content processing pipeline - almost certainly within WebKit, Apple's shared browser rendering engine used across Safari, WKWebView on iOS/iPadOS, and macOS. The CPE data confirms three affected Apple product families: apple:safari, apple:ios_and_ipados, and apple:macos, reflecting WebKit's cross-platform presence. Apple's fix was delivered via improved memory management, a standard mitigation for UAF bugs. Because iOS and iPadOS mandate WebKit for all browser engines, the affected surface extends to third-party browsers on those platforms that use WKWebView.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network-delivered via webpage (AV:N), trivial delivery (AC:L), no privileges required (PR:N), user must visit page (UI:R), impact is process crash only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

MEDIUM 6.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Prevalence

High

default browser across all Apple devices globally

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Denial Of Service

View all

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43734 ADVISORY https://vuldb.com/vuln/374747 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy