CVE-2026-43707: Apple Memory Corruption Denial of Service in Safari and iOS

Technical summary

CVE-2026-43707 is a memory corruption flaw (CWE-119) in Apple's WebKit rendering engine and related OS components. The vulnerability exists in how these platforms process web content; when memory handling fails to properly validate or sanitize certain inputs, an attacker-controlled webpage can trigger an out-of-bounds write or similar memory safety violation. This leads to an unexpected process termination. The CVSS v3.1 score of 6.5 (MEDIUM) reflects network-based attack vector, low attack complexity, no privilege requirement, and user interaction requirement, with high availability impact but no confidentiality or integrity impact.

Business impact

End users experience denial of service when encountering malicious web content, disrupting browsing and potentially affecting business workflows that depend on Safari or embedded WebKit browsers. Organizations managing iOS and macOS fleets should anticipate support tickets from users whose applications crash unexpectedly. The lack of data breach or code execution risk means this is not a critical business-continuity threat, but availability disruption warrants timely remediation to maintain user productivity and reduce support burden.

Affected systems

Apple Safari (all versions before 26.5.2), iOS (before 26.5.2), iPadOS (before 26.5.2), macOS Tahoe (before 26.5.2), tvOS (before 26.6), visionOS (before 26.6), and watchOS (before 26.6) are vulnerable. Any device running these OS versions or Safari is at risk when users navigate to attacker-controlled or compromised websites. This spans consumer devices, enterprise-managed Apple hardware, and embedded Apple platforms.

Exploitability

Exploitation requires minimal effort: an attacker simply hosts or injects malicious web content and waits for users to visit. No advanced techniques, authentication, or system access are needed. However, the user must actively navigate to the malicious page—the vulnerability cannot be triggered remotely without user action. Public exploit code is unlikely given the specificity of memory corruption bugs, but proof-of-concept development is feasible for skilled researchers. This vulnerability is not listed in the CISA KEV catalog, indicating no evidence of active in-the-wild exploitation at the time of CVE publication.

Remediation

Patch immediately to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, or watchOS 26.6, depending on the affected device. For organizations, enforce automatic OS updates or issue patch deployment guidance to users. Verify patch installation through Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS, and equivalent paths on other platforms. No workarounds exist short of avoiding untrusted websites or disabling JavaScript (not practical).

Patch guidance

Apply the vendor-supplied security updates from Apple immediately. For iOS, iPadOS, and macOS devices, enable automatic updates to ensure timely patch deployment. Organizations with managed device fleets should use Mobile Device Management (MDM) solutions to enforce updates. Verify patch status post-update by confirming the Safari and OS version numbers match the fixed versions listed above. Apple typically rolls out updates gradually; monitor completion rates and re-push to any stragglers within 30 days of release.

Detection guidance

Monitor for unexpected Safari or app crashes in your user base through device telemetry and MDM reporting. Correlate crash logs with malicious website access or phishing campaigns if possible. On the network side, IDS/IPS solutions cannot reliably detect this attack at the traffic layer (it manifests as normal web traffic containing specific malformed content). Endpoint detection should focus on anomalous process termination events and user complaints about browsing crashes. Threat intelligence feeds may identify known malicious URLs exploiting this vulnerability post-discovery.

Why prioritize this

While the CVSS score of 6.5 is medium, this vulnerability merits above-average prioritization because (1) it affects all major Apple platforms simultaneously, (2) exploitation is trivial and user-initiated, (3) the attack surface is massive (any visited webpage), and (4) organizations with large Apple deployments face widespread availability risk. However, the lack of data breach or code execution capability and absence of KEV activity keep it below critical priority. Organizations with significant iOS/macOS user bases should treat this as high-priority; others may schedule it within standard patching windows.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a balance of factors: Network-based attack vector and low attack complexity increase risk, as does the absence of privilege or special access requirements. However, mandatory user interaction (visiting a webpage) reduces the overall score. The lack of confidentiality or integrity impact further limits the score; only availability is affected. In a real-world context, the breadth of affected Apple devices and the ease of exploitation push practical risk higher than the CVSS number alone suggests, justifying prioritization above a typical MEDIUM-severity patch.

Frequently asked questions