Apple Safari EUVD-2026-40199

| CVE-2026-43745 MEDIUM

Out-of-bounds Write (CWE-787)

2026-06-29 apple

GHSA-jwf6-8r5m-99c4

Buffer Overflow Memory Corruption Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host maliciously crafted webpage
Delivery

Deliver URL to victim via phishing or redirect
Exploit

Victim loads page in unpatched Safari
Execution

Web content processing triggers out-of-bounds write
Impact

Memory corruption causes Safari process crash

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a victim to actively navigate to an attacker-controlled URL using an unpatched version of Safari on iOS, iPadOS, or macOS Tahoe prior to 26.5.2. The CVSS UI:R metric confirms passive exploitation is not possible - the user must load the malicious page. No authentication is required on the attacker's side (PR:N), and no special Safari configuration or non-default settings are required; any default Safari installation on an affected platform is vulnerable when the user visits attacker-controlled content. Exploitation is limited by: (1) mandatory user interaction to visit the malicious URL; (2) impact is confined to crashing the Safari process with no confirmed code execution, data exfiltration, or privilege escalation; and (3) the unchanged scope (S:U) means the vulnerability does not cross process or privilege boundaries based on available data.
Impact	The CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H correctly reflects network reachability with no authentication or complexity barriers, but requires active user interaction (UI:R) and produces only an availability impact - a Safari crash rather than code execution. The unchanged scope (S:U) and absence of confidentiality or integrity impact (C:N/I:N) confirm this is a denial-of-service class issue. No EPSS score was provided, precluding probabilistic exploitation assessment. There is no CISA KEV listing and no POC has been identified, meaning real-world risk at the time of analysis is lower than the broad install base alone might suggest. The primary concern is the ubiquity of Safari across Apple's ecosystem: a trivially triggered browser crash via a malicious link is a low-barrier disruption, particularly in enterprise iOS environments. Out-of-bounds writes of this class can sometimes be escalated to code execution through additional chaining, but no such escalation is evidenced in the available data - callers should not assume RCE without further vendor or researcher disclosure.
Exploit ScenarioDerived	An attacker crafts a webpage containing specially structured content - such as malformed JavaScript objects, crafted media, or malicious HTML - designed to trigger an out-of-bounds write in Safari's web content processing pipeline. A victim on an unpatched Apple device is sent or lured to the URL, and upon loading the page in Safari, the browser crashes due to memory corruption in the rendering engine. No public exploit code has been confirmed; exploitation is limited to causing a denial-of-service crash of the Safari process.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 29, 2026

Safari's web content processing engine on iOS, iPadOS, and macOS Tahoe contains an out-of-bounds write (CWE-787) that causes an unexpected crash when rendering maliciously crafted web content. All Safari versions prior to 26.5.2 - and the underlying WebKit engine shipping with iOS/iPadOS and macOS Tahoe prior to 26.5.2 - are affected. Apple has released patched versions across all three platforms; no public exploit code or CISA KEV listing has been identified at time of analysis, and available impact is limited to a denial-of-service crash with no confirmed code execution path.

RemediationAI

Update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2, all of which Apple has released to address this vulnerability. Updates are available through Apple Software Update on macOS and via Settings > General > Software Update on iOS and iPadOS. Full advisory details are at https://support.apple.com/en-us/127594 (Safari), https://support.apple.com/en-us/127595 (iOS/iPadOS), and https://support.apple.com/en-us/127685 (macOS). As a compensating control prior to patching, users can restrict browsing to known-trusted sites and avoid following unsolicited links - this materially reduces exposure but limits browser utility and is not a substitute for patching. On iOS and iPadOS, Safari cannot be replaced as the underlying WebKit engine, making the OS-level update the only structural fix for that platform.

Affected VersionsENISA

iOS and iPadOS 0 <26.5.2

macOS 0 <26.5.2

Safari 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

CWE-787 (Out-of-Bounds Write) describes a class of memory-safety flaw where a write operation targets a memory address outside the allocated buffer's boundaries, leading to heap or stack corruption. In Safari's context, this vulnerability resides in the web content processing pipeline - most likely WebKit, Apple's open-source browser engine used across all Apple platforms. Crafted HTML, JavaScript, CSS, or media content can trigger the bounds violation during parsing or rendering. CPE strings (cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirm the flaw spans Safari as a standalone application on macOS and as the mandatory browser engine embedded in iOS and iPadOS. Apple's advisory credits improved input validation as the fix mechanism, consistent with a parser-level bounds check being absent or insufficient in the affected code path.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network delivery with no privileges needed, but UI:R is correct since victim must visit the page; crash-only outcome sets C:N/I:N and A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

MEDIUM 6.5

DescriptionCVE.org

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Ubiquitous

default browser and WebKit engine across all Apple iOS, iPadOS, macOS devices

Social Media

1

Sightings

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43745 ADVISORY https://vuldb.com/vuln/374758 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy