Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-03-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unexpected Process Crash
Action: Immediate Patch
AI Analysis

Impact

An issue with memory handling in WebKitGTK allows processing of maliciously crafted web content to trigger an unexpected process crash. The flaw is a buffer overflow or out-of-bounds write (CWE-120 and CWE-787), leading to a denial of service when the browser renders the content.

Affected Systems

Apple Safari running on macOS, iOS, iPadOS and visionOS is affected. Versions prior to Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 contain vulnerable code. Update to the respective 26.4 releases to obtain the patch.

Risk and Exploitability

The CVSS base score of 4.3 indicates moderate severity, but the EPSS score below 1% and absence from CISA's KEV catalog suggest a low likelihood of exploitation. Attackers would need to craft malicious web content and deliver it to a user’s browser. The impact is primarily availability, as the crash causes a denial of service but does not compromise confidentiality or integrity.

Generated by OpenCVE AI on March 31, 2026 at 05:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the 26.4 update for Safari, iOS, iPadOS, macOS Tahoe, and visionOS to eliminate the crash vulnerability.
  • If immediate update is not possible, avoid browsing untrusted or malicious web content that could trigger the crash.
  • Continue monitoring Apple security advisories for future updates or related advisories.

Generated by OpenCVE AI on March 31, 2026 at 05:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unexpected Crash from Malicious Web Content in Safari and Apple Operating Systems webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unexpected Crash from Malicious Web Content in Safari and Apple Operating Systems

Wed, 25 Mar 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 25 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Wed, 25 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:25:52.860Z

Reserved: 2025-11-11T14:43:07.865Z

Link: CVE-2026-20664

cve-icon Vulnrichment

Updated: 2026-03-25T15:20:38.595Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:04.947

Modified: 2026-03-25T20:53:38.090

Link: CVE-2026-20664

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-28T20:00:00Z

Links: CVE-2026-20664 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T20:09:14Z

Weaknesses