Apple Safari EUVD-2026-40207

The sole exploitation condition is that the target user processes maliciously crafted web content in Safari - in practice, visiting an attacker-controlled or attacker-injected webpage. The CVSS vector PR:N/UI:R confirms no authentication or privileges are required from the attacker's side, but the victim must actively load the content (e.g., click a link, visit a site with a malicious ad, or open a web-based document). No non-default configuration, specific feature enablement, or platform-specific setting is required - the flaw is in the core web content processing path used on every navigation. Limiting factors include: (1) user interaction is required, preventing fully automated mass exploitation; (2) impact is confined to a crash - there is no confirmed code execution path from available data; (3) the fix is available in a standard OS/browser update, reducing the window for exploitation on managed device fleets.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H yields a score of 6.5 (Medium), reflecting a low-complexity, unauthenticated network attack that nonetheless requires user interaction and produces only a DoS outcome. The C:N/I:N impact metrics sharply limit real-world severity - this is a crash, not a compromise. No EPSS data was provided, so exploitation probability cannot be quantified; however, the absence of a CISA KEV listing and no reported public POC suggests opportunistic mass exploitation is not currently occurring. The UI:R requirement (user must load the malicious content) is a meaningful friction point but is trivially exploited via phishing links or malicious advertisements. The primary risk is service disruption to Safari users - relevant for environments where browser uptime is operationally critical (e.g., kiosk deployments, WebKit-based enterprise apps on iOS). There is no confirmed escalation path to code execution based on available data, though UAF bugs inherently carry that latent risk in principle.

An attacker registers or compromises a website and embeds maliciously crafted web content designed to trigger the use-after-free condition in Safari's rendering engine. A victim user on an unpatched Apple device navigates to the page - via a phishing link, malicious advertisement, or QR code redirect - causing Safari to process the crafted content and crash. The attack requires no authentication and no special target configuration; any Safari user visiting the page is susceptible to the DoS. No public proof-of-concept code has been identified at time of analysis.