Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-08-17
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Process crash leading to denial of service
Action: Update immediately
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in Apple’s web content processing, triggered by maliciously crafted web pages. It has been addressed by improving memory management. The fix is included in Safari 26.6.1, iPadOS 18.7.10 and 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27, leading to a denial‑of‑service condition.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices running versions older than Safari 26.6.1, iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, or watchOS 27 are affected. Updated releases include Safari 26.6.1, iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating a low but non‑zero exploitation probability. The CVSS score of 6.5 indicates a medium severity. It is inferred that an attacker would need to lure a user to a malicious website that serves specially crafted content, which could trigger the crash. Although the flaw does not provide direct remote code execution, it can be used to disrupt device operation and create a denial‑of‑service condition, especially if the crash occurs in a critical subsystem.

Generated by OpenCVE AI on September 21, 2026 at 07:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest iOS, iPadOS, and macOS the memory‑management patch.
  • Enable automatic updates to ensure the device receives these patches without manual intervention.
  • Avoid browsing untrusted or malicious websites until the operating system is fully patched, as this is the only practical temporary measure until the official fixes are installed.

Generated by OpenCVE AI on September 21, 2026 at 07:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Thu, 27 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free Bug Leading to Process Crash in Safari and Apple OS webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Use-After-Free Bug Leading to Process Crash in Safari and Apple OS

Tue, 18 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Apple safari

Tue, 18 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Title Use‑After‑Free Crash Vulnerability in Apple iOS, iPadOS, and macOS
References

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Crash Vulnerability in Apple iOS, iPadOS, and macOS
Weaknesses CWE-416

Mon, 17 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T20:47:52.858Z

Reserved: 2026-07-20T18:09:35.084Z

Link: CVE-2026-64715

cve-icon Vulnrichment

Updated: 2026-08-18T13:21:23.452Z

cve-icon NVD

Status : Modified

Published: 2026-08-17T22:17:17.343

Modified: 2026-09-14T21:17:14.173

Link: CVE-2026-64715

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-17T21:29:27Z

Links: CVE-2026-64715 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T07:30:08Z

Weaknesses