Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.
Published: 2026-06-29
Score: 8.8 High
EPSS: 1.3% Low
KEV: No
Impact: memory corruption risk
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free issue that was addressed by improving memory management. The flaw, classified as CWE‑416, is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, iOS 26.7, iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption, which can cause application crashes or potentially allow an attacker to gain unauthorized control.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are the affected products. Versions older than 26.5.2 (for Safari, iOS, iPadOS, macOS) or 26.6 (for tvOS, visionOS, watchOS) contain the flaw; the issue was addressed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, iOS 26.7, iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity and the EPSS score is < 1%. The vulnerability is not listed in CISA's KEV catalog. The flaw requires the processing of malicious web content to trigger the use‑after‑free. Based on the description, it is inferred that an attacker could craft such content to exploit the flaw, leading to memory corruption.

Generated by OpenCVE AI on September 21, 2026 at 07:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Apple‑released patch (Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2) which resolves the CWE‑416 use‑after‑free flaw.
  • Enable automatic updates so subsequent security patches are applied automatically.
  • If patching cannot be performed immediately, restrict web browsing to trusted domains and disable or block potentially malicious content types (e.g., plugins, extensions) to reduce the chance that crafted content triggers the vulnerability.
  • Monitor system logs for evidence of memory corruption or crashes that might indicate exploitation, and investigate promptly.

Generated by OpenCVE AI on September 21, 2026 at 07:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6398-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-8703-1 WebKitGTK vulnerabilities
History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.
References

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.
References

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 30 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 00:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Leading to Memory Corruption in Apple Safari, iOS, iPadOS, and macOS

Mon, 29 Jun 2026 22:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Leading to Memory Corruption in Apple Safari, iOS, iPadOS, and macOS

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T20:47:16.886Z

Reserved: 2026-05-01T22:46:21.644Z

Link: CVE-2026-43715

cve-icon Vulnrichment

Updated: 2026-06-29T21:15:26.745Z

cve-icon NVD

Status : Modified

Published: 2026-06-29T20:17:36.173

Modified: 2026-09-14T21:17:09.273

Link: CVE-2026-43715

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43715 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T07:30:08Z

Weaknesses