CVE-2026-39872 - Vulnerability Details

- webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Published: 2026-06-29

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue is an improper memory handling flaw in Apple WebKitGTK that processes maliciously crafted web content. When such content is rendered, an unexpected process crash can occur, causing a denial‑of‑service condition. The flaw does not allow remote code execution or privilege escalation. The referenced CWEs, CWE-119 and CWE-416, indicate a type‑of‑memory‑corruption fault and a use‑after‑free condition.

Affected Systems

Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS are impacted. The flaw has been fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Earlier releases of these operating systems remain vulnerable.

Risk and Exploitability

The description does not explicitly state the attack vector; it is inferred that an attacker could deliver malicious web content via a compromised website or network element to trigger the crash. The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.5.2

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 26.5.2

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5.2

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Apple

Safari

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Safari to version 26.5.2 or later
Upgrade iOS to version 26.5.2 or later
Upgrade iPadOS to version 26.5.2 or later
Upgrade macOS Tahoe to version 26.5.2 or later
Upgrade tvOS to version 26.6 or later
Upgrade visionOS to version 26.6 or later
Upgrade watchOS to version 26.6 or later

Generated by OpenCVE AI on August 3, 2026 at 06:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6398-1	webkit2gtk security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00244.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugs.webkit.org/show_bug.cgi?id=313528
https://nvd.nist.gov/vuln/detail/CVE-2026-39872
https://support.apple.com/en-us/127594
https://support.apple.com/en-us/127595
https://support.apple.com/en-us/127685
https://support.apple.com/en-us/128068
https://support.apple.com/en-us/128069
https://support.apple.com/en-us/128070
https://webkitgtk.org/security/WSA-2026-0004.html
https://www.cve.org/CVERecord?id=CVE-2026-39872

History

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
References		https://support.apple.com/en-us/128068 https://support.apple.com/en-us/128069 https://support.apple.com/en-us/128070

Fri, 17 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Improper Memory Handling in Safari, iOS, and macOS Allows Malicious Web Content to Cause Process Crashes	webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References		https://bugs.webkit.org/show_bug.cgi?id=313528 https://nvd.nist.gov/vuln/detail/CVE-2026-39872 https://webkitgtk.org/security/WSA-2026-0004.html https://www.cve.org/CVERecord?id=CVE-2026-39872
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 30 Jun 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Improper Memory Handling in Safari, iOS, and macOS Allows Malicious Web Content to Cause Process Crashes

Tue, 30 Jun 2026 02:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple safari
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple safari

Tue, 30 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Safari, iOS, iPadOS, and macOS Crash from Malicious Web Content Due to Improper Memory Handling
Weaknesses	CWE-787

Mon, 29 Jun 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 29 Jun 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		Safari, iOS, iPadOS, and macOS Crash from Malicious Web Content Due to Improper Memory Handling
Weaknesses		CWE-119 CWE-787

Mon, 29 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References		https://support.apple.com/en-us/127594 https://support.apple.com/en-us/127595 https://support.apple.com/en-us/127685

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-06-29T19:43:09.579Z

Updated: 2026-07-27T20:14:23.166Z

Reserved: 2026-04-07T19:58:20.173Z

Link: CVE-2026-39872

Vulnrichment

Updated: 2026-06-29T21:46:13.180Z

NVD

Status : Modified

Published: 2026-06-29T20:17:34.040

Modified: 2026-07-27T21:16:51.180

Link: CVE-2026-39872

Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-39872 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T07:00:05Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object