Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-08-17
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in Apple’s memory management that can be triggered by maliciously crafted web content. It has been addressed with improved memory management; the issue is fixed in Safari 26.6.1, iOS 18.7.10 and 26.6.1, iPadOS 18.7.10 and 26.6.1, and macOS Tahoe 26.6.2. Processing such content may lead to an unexpected process crash, resulting in instability and potential denial of service. The flaw does not provide code execution or data disclosure.

Affected Systems

Apple iOS and iPadOS devices running versions older than iOS 18.7.10 and iOS 26.6.1, iPadOS older than iOS 18.7.10 and iOS 26.6.1, and macOS Tahoe versions older than 26.6.2 are affected. Updated releases are iOS 18.7.10/26.6.1, iPadOS 18.7.10/26.6.1, and macOS Tahoe 26.6.2.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating a low but non-zero exploitation probability. The CVSS score of 6.5 indicates a medium severity. It is inferred that an attacker would need to lure a user to a malicious website that serves specially crafted content, which could trigger the crash. Although the flaw does not provide direct remote code execution, it can be used to disrupt device operation and create a denial-of-service condition, especially if the crash occurs in a critical subsystem.

Generated by OpenCVE AI on August 18, 2026 at 20:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest iOS, iPadOS, and macOS updates as released by Apple, which include the memory‑management patch.
  • Enable automatic updates to ensure the device receives these patches without manual intervention.
  • Avoid browsing untrusted or malicious websites until the operating system is fully patched, as this is the only practical temporary measure until the official fixes are installed.

Generated by OpenCVE AI on August 18, 2026 at 20:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free Bug Leading to Process Crash in Safari and Apple OS webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Use-After-Free Bug Leading to Process Crash in Safari and Apple OS

Tue, 18 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Apple safari

Tue, 18 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Title Use‑After‑Free Crash Vulnerability in Apple iOS, iPadOS, and macOS
References

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Crash Vulnerability in Apple iOS, iPadOS, and macOS
Weaknesses CWE-416

Mon, 17 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-18T17:59:21.972Z

Reserved: 2026-07-20T18:09:35.084Z

Link: CVE-2026-64715

cve-icon Vulnrichment

Updated: 2026-08-18T13:21:23.452Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T22:17:17.343

Modified: 2026-08-18T19:01:58.230

Link: CVE-2026-64715

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-17T21:29:27Z

Links: CVE-2026-64715 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T20:30:17Z

Weaknesses