Apple WebKit EUVD-2026-60485

| CVE-2026-64715 MEDIUM

Use After Free (CWE-416)

2026-08-17 apple

GHSA-f338-c843-j6jp

Denial Of Service Use After Free Memory Corruption Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host maliciously crafted webpage
Delivery

Lure victim via phishing or malvertising
Exploit

Victim visits URL on unpatched Apple device
Execution

WebKit processes crafted web content
Persist

Use-after-free triggered in memory management
Impact

Web renderer process crashes unexpectedly

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	User interaction is required - the victim must actively visit or be directed to a maliciously crafted webpage, confirmed by the CVSS UI:R metric. No authentication, no special configuration, and no elevated privileges are required on the attacker's side (PR:N, AC:L). Any device running unpatched iOS prior to 18.7.10 or 26.6.1, or macOS Tahoe prior to 26.6.2, using any WebKit-based browser (all iOS/iPadOS browsers are WebKit-based by platform mandate) is susceptible. Exploitation is bounded by impact: the outcome is a process crash (A:H) with no confidentiality or integrity consequences (C:N/I:N), limiting attacker utility to denial of service rather than data theft or code execution.
Impact	The CVSS 6.5 Medium score reflects a real but bounded risk: the attack is network-delivered with low complexity and requires no authentication, but demands active user interaction (UI:R) - the victim must visit a malicious page - and the outcome is limited to an availability impact (process crash), not remote code execution. No EPSS data was provided; however, given the absence of KEV listing and no public PoC, opportunistic mass exploitation is unlikely at this time. The dual-branch patching (iOS 18.x and iOS 26.x) is a meaningful signal - Apple patched across both maintenance and current release trains, suggesting broader customer exposure and elevated Apple-internal priority. Impact limited to C:N/I:N/A:H aligns with a denial-of-service classification (crash, not code execution), lowering the real-world urgency compared to a full memory corruption leading to RCE. For enterprise mobile fleets, the risk is process disruption rather than data exfiltration.
Exploit ScenarioDerived	An attacker crafts a webpage containing malicious web content designed to trigger a use-after-free in WebKit's memory management during DOM or JavaScript object processing. The attacker distributes the link via phishing, malicious ads, or a compromised website, and when a victim on an unpatched Apple device visits the page, the WebKit renderer crashes, causing an unexpected process termination and browser denial of service. No public proof-of-concept exploit code has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Aug 18, 2026

Use-after-free memory corruption in Apple's WebKit web rendering engine crashes the browser process when handling maliciously crafted web content on iOS, iPadOS, and macOS Tahoe. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network-reachable exploitation limited to availability impact - a process crash - with no confidentiality or integrity compromise. Apple has released fixes across both the legacy iOS 18.x branch and the current iOS 26.x line, indicating broad exposure across the installed base. No active exploitation or public proof-of-concept has been identified at time of analysis.

RemediationAI

Apply the vendor-released patches immediately: update iOS and iPadOS to version 18.7.10 or 26.6.1, and macOS Tahoe to version 26.6.2, available via Apple Software Update. Advisory references: https://support.apple.com/en-us/148281, https://support.apple.com/en-us/148282, https://support.apple.com/en-us/148287. As a compensating control prior to patching, organizations can restrict access to untrusted web content by enforcing content filtering or mobile device management (MDM) policies that block navigation to unapproved or unknown URLs - this reduces exposure to maliciously crafted pages at the cost of user browsing flexibility. Safari's fraudulent website warning and safe browsing features should remain enabled. No workaround fully eliminates risk without patching, as any WebKit-based browser on the affected OS is susceptible.

Affected VersionsENISA

iOS and iPadOS 0 <26.6.1

macOS 0 <26.6.2

iOS and iPadOS 0 <18.7.10

Affected Packages

euvd ios_and_ipados fix: 18.7.10, 26.6.1

euvd macos fix: 26.6.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

CWE-416 (Use After Free) describes a class of memory safety flaw where a program continues to reference a memory region after it has been freed, creating conditions for memory corruption or controlled crashes. In WebKit - Apple's browser engine embedded in Safari and mandated for all iOS/iPadOS browsers - the processing of web content involves complex DOM and JavaScript object lifecycle management, where use-after-free conditions commonly arise from asynchronous callback patterns or garbage collection timing issues. Apple resolved the issue via improved memory management per their advisories. Affected products per CPE data are cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos, covering both iOS/iPadOS 18.x legacy and 26.x current branches, as well as macOS Tahoe.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network-delivered via crafted webpage (AV:N), victim must actively visit the page (UI:R), crash-only outcome with no data exposure or integrity loss (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

CVSS changed

Aug 18, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Aug 17, 2026 - 22:03 EUVD

CVE Published

Aug 17, 2026 - 21:29 cve.org

MEDIUM 6.5

CVE Published

Aug 17, 2026 - 21:29 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Zero Day Initiative Advisories

ZDI-26-610 Apple Safari JavaScriptCore B3 ReduceStrength Phase Use-After-Free Remote Code Execution Vulnerability Aug 2026

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Prevalence

High

iOS and macOS dominant across global consumer and enterprise endpoints

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact· derived

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

CVE-2026-84609 CRITICAL Act Now

A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvO

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Denial Of Service

View all

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64715 ADVISORY https://seclists.org/oss-sec/2026/q3/976 ADVISORY https://vuldb.com/vuln/391473 REF https://support.apple.com/en-us/148281 REF https://support.apple.com/en-us/148282 REF https://support.apple.com/en-us/148286 REF https://support.apple.com/en-us/148287 REF https://support.apple.com/en-us/149036 REF https://support.apple.com/en-us/149037 REF https://support.apple.com/en-us/149038

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy