Apple Safari EUVD-2026-40213

No special server-side configuration or non-default product setting is required: the vulnerability is triggered by the act of processing (rendering/visiting) maliciously crafted web content in Safari. The CVSS vector (UI:R) confirms that victim interaction - specifically navigating to or loading attacker-controlled content - is the sole prerequisite on the victim side. The CVSS PR:N metric confirms no authentication to any service is required from the attacker's perspective. Limiting factors include: (1) the victim must actively visit or be redirected to a page delivering the malicious content; (2) impact is confirmed only as availability (crash) - confidentiality and integrity are unaffected per C:N/I:N in the CVSS vector; (3) exploitation beyond DoS to achieve code execution is not confirmed from available data, though UAF primitives carry theoretical escalation potential.

The CVSS 6.5 Medium score reflects a real but bounded threat: AV:N/AC:L/PR:N makes this trivially reachable over the internet with no attacker-side privileges or configuration required, but UI:R (victim must visit a page) introduces a meaningful social engineering barrier. The impact triple C:N/I:N/A:H limits the confirmed outcome to a denial of service (Safari crash), not code execution or data exfiltration - a significant risk distinction given that UAF bugs can sometimes be escalated to RCE. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no POC has been identified at time of analysis, suggesting no observed active exploitation. Real-world priority should be moderate: patch promptly on managed fleets (particularly enterprise iOS/macOS estates) but this does not represent the same urgency as a confirmed RCE or KEV-listed issue. The broad Apple device footprint elevates aggregate exposure even if per-device impact is limited to a crash.

An attacker crafts a webpage containing malicious HTML, JavaScript, or media content designed to trigger the use-after-free condition in WebKit's memory management. A victim is directed to this page via phishing, malvertising, or a compromised site and opens it in Safari on macOS, iPhone, or iPad - causing the Safari process to crash unexpectedly. No public POC exists at time of analysis, so real-world exploitation would currently require an attacker with independent vulnerability research capability.