Apple Safari EUVD-2026-40206

| CVE-2026-43707 MEDIUM

Buffer Overflow (CWE-119)

2026-06-29 apple

GHSA-fpv3-789h-j3j4

Buffer Overflow Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious page
Delivery

Deliver crafted web content
Exploit

Trigger WebKit buffer overflow
Execution

Corrupt rendering-process memory
Impact

Crash content process (DoS)

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to process attacker-controlled web content in WebKit - i.e., open a malicious page in Safari or load it via an embedded WebKit view - so a content-delivery channel (a link, malicious site, malvertising, or compromised page) is the concrete prerequisite. The realistic limiting factor is that the victim must actually load the attacker's content, despite Apple's vector marking UI:N; impact is further limited to an unexpected process crash (availability only) with no demonstrated path to data disclosure or code execution. It affects only Apple platforms running Safari/iOS/iPadOS/macOS versions before 26.5.2.
Impact	Signals are consistent and point to moderate, not critical, real-world risk. The CVSS 7.5 score is driven entirely by High availability impact (process crash); confidentiality and integrity are explicitly N, so this is a denial-of-service condition, not RCE. EPSS is low at 0.16% (6th percentile), the vulnerability is not in CISA KEV, and no POC is referenced - all aligning toward low likelihood of widespread exploitation. One discrepancy worth flagging: Apple rates the vector UI:N, but the description ('Processing maliciously crafted web content') implies the victim must load attacker-controlled content, which normally maps to UI:R - verify the interaction assumption before relying on the unauthenticated/no-interaction framing. Net priority: patch in the normal cycle; this is a high-CVSS-but-DoS-only issue rather than an urgent emergency.
Exploit ScenarioDerived	An attacker hosts a malicious web page or serves crafted content through an ad/iframe and lures a victim to open it in Safari or any app rendering web content via WebKit. When the engine parses the content, the buffer-handling flaw corrupts memory and crashes the rendering process, producing a denial of service. No public exploit code is identified, and the available data indicates a crash only, not code execution.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 30, 2026

Denial-of-service memory corruption in Apple's WebKit engine affects Safari, iOS/iPadOS, and macOS Tahoe before version 26.5.2, where processing maliciously crafted web content triggers an unexpected process crash. The CVSS vector scores only availability impact (A:H) with no confidentiality or integrity loss, indicating a crash rather than code execution. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.16%), consistent with a browser-rendering DoS reported internally by Apple rather than an actively exploited threat.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which contain the improved memory handling fix; this is the primary and recommended action per Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. If immediate patching is not possible on managed fleets, reduce exposure by limiting browsing of untrusted sites and, on managed devices, applying content-filtering or web-proxy policies to block untrusted/unknown web content - note this degrades user browsing convenience and does not address content delivered via in-app WebKit views (WKWebView), which share the engine. Because impact is limited to a process crash with no confidentiality or integrity loss, emergency out-of-band action is generally not warranted; fold the update into the standard patch cycle.

Affected VersionsENISA

macOS 0 <26.5.2

Safari 0 <26.5.2

iOS and iPadOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The flaw resides in WebKit, the browser engine underpinning Safari and all web-content rendering on Apple platforms (iOS, iPadOS, macOS). It is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and tagged as a Buffer Overflow, meaning the engine mishandles memory boundaries when parsing or rendering attacker-controlled web content. The CPE data confirms the issue spans three distinct Apple product surfaces - cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, and cpe:2.3:a:apple:macos - because they share the same underlying WebKit code. Apple's fix description ('addressed with improved memory handling') indicates the corruption was remediated by hardening bounds/lifetime handling rather than a logic redesign.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network-delivered web content with low complexity and no privileges, but the victim must load the malicious content (UI:R); impact is a crash, so only A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

6

Severity Changed

Jun 30, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 30, 2026 - 20:22 NVD

7.5 (HIGH) 6.5 (MEDIUM)

CVSS changed

Jun 30, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:43 cve.org

HIGH 7.5

DescriptionCVE.org

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

Apple devices running Safari, iOS, or macOS Tahoe prior to version 26.5.2 are vulnerable to application crashes triggered by malicious web content, potentially affecting a significant portion of the organization's mobile and desktop workforce. While this vulnerability does not enable data theft or system compromise, the broad user base relying on Apple devices means outages could disrupt multiple business processes. Patching to version 26.5.2 or later is recommended to maintain employee productivity and system reliability.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Ubiquitous

Safari/WebKit ships on every iPhone, iPad, and Mac

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Medium

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2020-0796 CRITICAL POC

CVE-2017-11882 HIGH POC

CVE-2014-6332 HIGH POC

CVE-2015-2426 HIGH POC

CVE-2013-3918 HIGH POC

CVE-2023-4966 HIGH POC

CVE-2017-11774 HIGH POC

CVE-2013-3660 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43707 ADVISORY https://vuldb.com/vuln/374725 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy