Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-05-11
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apple has identified a memory handling flaw that can be triggered by maliciously crafted web content, causing an unexpected process crash. The flaw is classified as CWE-119 and CWE-120, indicating out‑of‑bounds memory access or buffer over‑read on a heap or stack buffer. The crash results in a denial‑of‑service condition for the damaged process.

Affected Systems

The vulnerability affects Apple Safari on all Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS and watchOS. It is fixed in Safari 26.5, iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5 and watchOS 26.5. Users running earlier versions of these products are potentially exposed when they open deceptive web content.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% shows that widespread exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker can embed maliciously crafted content into a web page or other web‑enabled application and deliver it to a user’s device, causing the Safari or associated process to crash.

Generated by OpenCVE AI on June 3, 2026 at 04:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Apple software updates that include Safari 26.5, iOS 18.7.9 or 26.5, iPadOS 18.7.9 or 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
  • Use browser or system settings to sandbox or restrict untrusted web content until the patch is applied.
  • Stay informed by subscribing to Apple security bulletins to receive future updates.

Generated by OpenCVE AI on June 3, 2026 at 04:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 03 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 14 May 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 13 May 2026 23:15:00 +0000

Type Values Removed Values Added
Title Memory Handling Flaw Causes Unexpected Process Crash via Malicious Web Content

Wed, 13 May 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
Title Memory Handling Flaw Causes Unexpected Process Crash via Malicious Web Content
References

Wed, 13 May 2026 18:45:00 +0000

Type Values Removed Values Added
Title Malicious Web Content Processing Crash in Apple OS
Weaknesses CWE-416

Wed, 13 May 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 11 May 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos

Mon, 11 May 2026 22:00:00 +0000

Type Values Removed Values Added
Title Malicious Web Content Processing Crash in Apple OS
Weaknesses CWE-416

Mon, 11 May 2026 20:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-05-13T19:58:45.369Z

Reserved: 2026-03-03T16:36:03.983Z

Link: CVE-2026-28903

cve-icon Vulnrichment

Updated: 2026-05-13T14:00:08.285Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-11T21:18:53.113

Modified: 2026-05-14T14:32:39.643

Link: CVE-2026-28903

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-28903 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-03T04:15:24Z

Weaknesses