Description
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash. The crash can lead to a denial‑of‑service condition for users.

Affected Systems

Apple Safari, Apple iOS, Apple iPadOS, Apple macOS Tahoe, Apple visionOS, and Apple watchOS are vulnerable in versions prior to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, and watchOS 26.6. The issue is resolved by applying the 26.5.2/26.6 security updates for all platforms.

Risk and Exploitability

Based on the description, it is inferred that the likely attack vector involves loading malicious web pages. The vulnerability can be triggered by such loading and is remotely exploitable over the network. It carries a CVSS score of 6.5, indicating medium severity. The EPSS score is 0.364%, suggesting a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Repeated crashes could disrupt user sessions and lead to denial‑of‑service.

Generated by OpenCVE AI on August 4, 2026 at 18:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Apple security updates for Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, and watchOS 26.6.
  • Regularly check the Apple Security Update Advisory page for any new updates or patches related to Safari, iOS, iPadOS, macOS, visionOS, or watchOS.
  • Until the update is installed, avoid visiting or loading content from untrusted or suspicious websites.

Generated by OpenCVE AI on August 4, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6398-1 webkit2gtk security update
History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 00:45:00 +0000

Type Values Removed Values Added
Title Safari Crash via Out-of-Bounds Access in Web Content
Weaknesses CWE-120

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Safari Crash via Out-of-Bounds Access in Web Content
Weaknesses CWE-120

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-27T20:12:48.625Z

Reserved: 2026-05-01T22:46:21.641Z

Link: CVE-2026-43676

cve-icon Vulnrichment

Updated: 2026-06-29T21:38:00.947Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43676 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T19:00:10Z

Weaknesses