Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper memory handling flaw in Safari, iOS, iPadOS, and macOS. According to the description, maliciously crafted web content can cause an unexpected process crash, resulting in a denial‑of‑service condition. The impact is limited to a process crash; no remote code execution or elevated privilege gain is indicated. The provided CWE identifiers (CWE-119 and CWE-416) confirm a type‑of‑memory‑corruption fault and a use‑after‑free condition.

Affected Systems

Apple Safari, iOS, iPadOS, and macOS Tahoe are impacted. The flaw has been fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Earlier releases of these operating systems remain vulnerable.

Risk and Exploitability

The description does not explicitly state the attack vector; it is inferred that an attacker could deliver malicious web content via a compromised website or network element to trigger the crash. The CVSS score of 6.5 indicates moderate severity. No EPSS data is available, so exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on June 30, 2026 at 02:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Safari to version 26.5.2 or later
  • Upgrade iOS to version 26.5.2 or later
  • Upgrade iPadOS to version 26.5.2 or later
  • Upgrade macOS Tahoe to version 26.5.2 or later

Generated by OpenCVE AI on June 30, 2026 at 02:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6398-1 webkit2gtk security update
History

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Improper Memory Handling in Safari, iOS, and macOS Allows Malicious Web Content to Cause Process Crashes webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
Title Improper Memory Handling in Safari, iOS, and macOS Allows Malicious Web Content to Cause Process Crashes

Tue, 30 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title Safari, iOS, iPadOS, and macOS Crash from Malicious Web Content Due to Improper Memory Handling
Weaknesses CWE-787

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Safari, iOS, iPadOS, and macOS Crash from Malicious Web Content Due to Improper Memory Handling
Weaknesses CWE-119
CWE-787

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-06-29T21:46:17.113Z

Reserved: 2026-04-07T19:58:20.173Z

Link: CVE-2026-39872

cve-icon Vulnrichment

Updated: 2026-06-29T21:46:13.180Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-39872 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-30T02:45:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free