Apple Safari EUVD-2026-40200

Exploitation requires that the victim actively visit or open maliciously crafted web content using an unpatched version of Safari, iOS, iPadOS, or macOS Tahoe - user interaction is mandatory (UI:R in CVSS). The attacker requires no authentication, no account on the target system, and no pre-existing access; delivering a malicious URL is sufficient. The vulnerability is constrained to web content processing, meaning it is triggered only in the context of browser rendering or WebKit-based in-app browsers. Exploitation is limited to causing a process crash (DoS); the CVSS vector records no confidentiality or integrity impact (C:N/I:N), so privilege escalation or data exfiltration are not confirmed outcomes. The scope is unchanged (S:U), meaning the crash is contained to the browser process and does not affect the host OS or other applications.

The CVSS 6.5 Medium score is consistent with a network-delivered, user-interaction-required denial-of-service: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Attack complexity is low and no authentication is required, meaning any public webpage can serve as a delivery vehicle, but the UI:R constraint means the victim must actively visit the malicious content. This significantly limits automated or mass-exploitation scenarios. No EPSS data was provided in the input, so probability of exploitation cannot be quantified from that signal. The vulnerability is not listed in CISA KEV, and no public proof-of-concept is identified, placing this in the 'no public exploit identified at time of analysis' category. The input tags flag 'Buffer Overflow' and 'Information Disclosure,' but the CVSS vector does not record confidentiality or integrity impact - these tags may reflect the theoretical class of CWE-125 rather than confirmed exploitation outcomes and should not be treated as confirmed impact vectors. Overall, real-world risk is moderate: impactful for Apple device users due to breadth of affected platforms, but constrained to browser-level crash (DoS) with no confirmed code execution or data leakage pathway. Defenders at organizations with large macOS/iOS fleets should prioritize patching but need not treat this as an emergency escalation in the absence of KEV listing or POC.

An attacker hosts a webpage containing specially crafted web content - such as a malformed HTML structure, JavaScript heap manipulation, or media payload - designed to trigger the out-of-bounds read in WebKit's memory handling routines. When a victim on an unpatched Apple device visits the URL via Safari, the rendering process reads beyond a valid memory boundary, triggering an unexpected crash and browser process termination. No public proof-of-concept is known at time of analysis, but the low attack complexity (AC:L) suggests this class of bug is straightforward to reproduce once the triggering condition is understood.