Apple Safari EUVD-2026-40205

The victim must actively visit or be redirected to a maliciously crafted web page using Safari on an unpatched Apple device - this is confirmed by UI:R in the CVSS vector. No authentication, account, or special configuration is required on the target system; any Safari user on a vulnerable iOS, iPadOS, or macOS version browsing untrusted content is at risk. Exploitation is limited by the need for user interaction: the attacker cannot trigger the vulnerability without the victim navigating to attacker-controlled or compromised web content. There is no evidence that this can be triggered via iMessage link preview, background fetch, or other zero-click vectors - available data supports only active browser navigation as the trigger. The flaw does not appear to require non-default Safari settings or specific extensions.

The CVSS base score of 6.5 (Medium) reflects the network-reachable, zero-privilege attack vector offset by mandatory user interaction (UI:R) and the scope-unchanged, availability-only impact (C:N/I:N/A:H). In practice, the barrier to exploitation is low - a single click on a malicious link suffices - placing practical exploitability closer to the upper end of Medium. The vendor description restricts the stated impact to an 'unexpected Safari crash' (DoS), which limits immediate business risk. However, use-after-free vulnerabilities in browser engines (particularly WebKit) warrant elevated attention: historically, such bugs have been leveraged for full remote code execution when memory layouts are favorable, even when the initial disclosure characterizes impact as DoS only. No EPSS score was provided in the input, so statistical exploitation probability cannot be quantified. KEV status is absent, and no POC has been identified, suggesting no confirmed or widespread exploitation at time of analysis. The primary realistic risk is service disruption for end users, with a secondary latent risk of undisclosed exploitation potential that cannot be ruled out from available data alone.

An attacker crafts a malicious webpage embedding content designed to trigger the use-after-free in WebKit's processing pipeline - for example, a specially structured HTML/JS payload that manipulates object lifecycle to cause a freed object to be dereferenced. A victim is directed to this page via a phishing link or a compromised advertisement, and upon Safari loading the content, the browser crashes. No public exploit code has been identified at time of analysis, so active weaponization of this specific CVE is not confirmed.