Apple Safari EUVD-2026-40210

| CVE-2026-43663 MEDIUM

Buffer Overflow (CWE-119)

2026-06-29 apple

GHSA-h545-qxq5-vpjg

Buffer Overflow Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker hosts malicious web page
Delivery

Victim clicks link or is redirected
Exploit

Safari/WebKit parses crafted content
Execution

Buffer overflow triggers in memory handler
Impact

Browser process crashes (DoS)

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the victim actively visit or be redirected to a maliciously crafted webpage - confirmed by the CVSS UI:R metric. The attack is network-delivered and requires no authentication on the attacker side (PR:N), but the victim must use Safari or a WebKit-based browser on an unpatched Apple device (Safari <26.5.2, iOS/iPadOS <26.5.2, or macOS Tahoe <26.5.2). On iOS and iPadOS, all third-party browsers also use WebKit due to Apple's platform restriction, meaning no browser on these platforms is immune prior to patching. Exploitation yields only a process crash (DoS); there is no confirmed code execution path. The scope is unchanged (S:U), meaning the crash does not escape the browser sandbox. Limiting factors: user must click a link or be redirected to the attacker-controlled page; the crash is recoverable by relaunching the browser; and the impact is non-persistent.
Impact	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately characterizes a moderate-severity denial-of-service: network-reachable, no privileges needed, low complexity, but requiring active user interaction (visiting a malicious page). The Availability impact is High (process crash), while Confidentiality and Integrity are both None, limiting the blast radius to service disruption rather than data compromise or code execution. No EPSS data was provided in the intelligence package, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. No public proof-of-concept exploit has been identified. The real-world risk is therefore moderate: the attack surface is enormous (billions of Apple devices), but exploitation yields only a crash, not persistent access, making it a low-value target for sophisticated threat actors. It remains meaningful for platforms where WebKit crashes affect availability SLAs (kiosks, enterprise managed devices). No conflicting signals between CVSS vector and description were observed.
Exploit ScenarioDerived	An attacker publishes a webpage containing maliciously crafted HTML, CSS, or JavaScript designed to trigger the WebKit buffer overflow. When a victim on an unpatched Apple device browses to this page using Safari (or any iOS/iPadOS browser, which all use WebKit), the content parser encounters the malformed input, corrupts memory, and causes the browser process to crash. Since no public exploit code has been identified, exploitation currently requires independent rediscovery of the triggering input by the attacker.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 29, 2026

Memory corruption in Apple's WebKit-based web content processing allows an unauthenticated remote attacker to crash the affected process by luring a user to visit a maliciously crafted webpage. Affected platforms include Safari, iOS, iPadOS, and macOS Tahoe, all prior to version 26.5.2. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; impact is limited to availability (process crash) with no confirmed confidentiality or integrity exposure.

RemediationAI

Vendor-released patch: Safari 26.5.2, iOS 26.5.2 / iPadOS 26.5.2, and macOS Tahoe 26.5.2. Users should update via Software Update on macOS or Settings > General > Software Update on iOS/iPadOS; Safari on macOS updates through the App Store or System Preferences. Apple advisory pages at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 provide release details. If immediate patching is not possible, restricting access to untrusted websites via content filtering (e.g., enterprise DNS/proxy block lists) reduces exposure but does not eliminate it, as any user-controlled browsing session could reach a malicious page. For managed device fleets, enforcing MDM-based OS update policies is the recommended compensating control, with the trade-off that forced update pushes may disrupt user workflows during rollout.

Affected VersionsENISA

macOS 0 <26.5.2

Safari 0 <26.5.2

iOS and iPadOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), and the tags confirm a buffer overflow root cause. Apple's advisory language - 'addressed with improved memory handling' - is consistent with an out-of-bounds read or write in the WebKit rendering engine, which is the shared HTML/CSS/JavaScript parsing and rendering library underlying Safari on macOS (cpe:2.3:a:apple:safari), as well as all browser engines on iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados) due to Apple's platform policy mandating WebKit. The macOS component (cpe:2.3:a:apple:macos) is likely affected through Safari or WebKit-consuming apps. Parsing or rendering specially crafted web content can trigger the improper memory operation, resulting in an unexpected process termination rather than arbitrary code execution, based on the A:H/C:N/I:N CVSS impact vector.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Web content delivery is network-based with no auth needed; user must visit the page (UI:R); crash-only impact means A:H with C:N and I:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Jun 29, 2026 - 22:22 NVD

6.5 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:43 cve.org

MEDIUM 6.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

High

default browser engine across billions of Apple iOS, iPadOS, macOS devices

Social Media

1

Sightings

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2020-0796 CRITICAL POC

CVE-2017-11882 HIGH POC

CVE-2014-6332 HIGH POC

CVE-2015-2426 HIGH POC

CVE-2013-3918 HIGH POC

CVE-2023-4966 HIGH POC

CVE-2017-11774 HIGH POC

CVE-2013-3660 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43663 ADVISORY https://vuldb.com/vuln/374720 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy