CVE-2026-43712: Safari WebKit Memory Handling Vulnerability (6.5 CVSS)

Technical summary

CVE-2026-43712 is a memory safety vulnerability affecting Apple's WebKit engine, the rendering core shared across Safari, iOS Safari, and iPadOS Safari. The issue stems from improper memory handling—specifically issues related to out-of-bounds reads (CWE-125) and buffer writes (CWE-787)—that can be triggered by processing maliciously crafted web content. The vulnerability results in a denial-of-service condition via unexpected process termination rather than information disclosure or code execution. The CVSS 3.1 score of 6.5 (Medium) reflects the availability impact (process crash) with no confidentiality or integrity risk, a network attack vector, low complexity, and reliance on user interaction to visit a malicious site.

Business impact

This vulnerability primarily threatens service continuity for Safari users across consumer and enterprise environments. In enterprise settings where Safari is used for critical web-based applications, unexpected crashes could disrupt workflows and productivity. The low barrier to exploitation (user must visit a website) makes it a vector for user frustration and potential social engineering campaigns that combine the crash trigger with secondary payloads. Organizations relying on Apple devices for secure or regulated workflows should consider the reputational and operational impact of frequent browser crashes.

Affected systems

The vulnerability impacts Safari 26.5.1 and earlier, iOS 26.5.1 and earlier, iPadOS 26.5.1 and earlier, macOS Tahoe 26.5.1 and earlier, tvOS 26.5 and earlier, visionOS 26.5 and earlier, and watchOS 26.5 and earlier. While Safari is the primary concern for most users, the underlying WebKit vulnerability means all browsing experiences on iOS and iPadOS are affected. tvOS, visionOS, and watchOS are secondary but still exposed via any web content rendering on those platforms.

Exploitability

Exploitation requires minimal attacker sophistication. No authentication, special network privileges, or local access are necessary. The attacker simply hosts a malicious website and waits for a user to visit—potentially via phishing, social engineering, or ad-network injection. User interaction is required (visiting the site), which is the only practical barrier. The crash is reliable and repeatable if the memory handling flaw is triggered correctly, though code execution is not possible via this vector.

Remediation

Apply the latest security updates released in late June and July 2026. Safari users should update to version 26.5.2 or later; iOS and iPadOS users must update to 26.5.2 or later; macOS Tahoe users must update to 26.5.2 or later; tvOS, visionOS, and watchOS users must update to 26.6 or later. These updates include improved memory handling that closes the vulnerability.

Patch guidance

Deploy the following versions or later: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. For IT teams managing Apple devices, prioritize deployment of iOS and iPadOS updates to company-issued iPhones and tablets, then macOS updates to laptops and desktops. Verify patch installation via Settings > [System Name] > About > [Software version]. Some devices may require a restart to finalize updates; consider staged rollout if critical browsing-dependent workflows are running.

Detection guidance

Detection is challenging without endpoint telemetry, as a successful exploit leaves no persistent artifacts—only a process crash. Organizations with device management and event logging enabled should monitor for elevated Safari crash frequencies or sudden unexplained browser terminations, which may indicate active exploitation attempts in the wild. Network-based detection is not practical unless the attacker's malicious website is already known; however, threat intelligence feeds may later identify common hosting patterns. Focus on user education: advise staff to avoid suspicious links and to report unexpected crashes.

Why prioritize this

While the CVSS score is Medium (6.5), the ease of user-triggered exploitation and ubiquity of Safari across Apple's ecosystem warrant prompt patching. Denial-of-service via crash may seem less critical than code execution, but in high-availability environments (call centers, trading floors, customer support teams) frequent unexpected crashes significantly degrade productivity. This is not a critical emergency requiring immediate 24-hour response, but it should be scheduled within the typical 30-day patch cycle for high-use user-facing applications.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-reachable, low-complexity attack that relies on user interaction and delivers only an availability impact (process crash). The absence of confidentiality and integrity impact prevents a higher score. However, the real-world exploitability is relatively high due to the ease of luring users to a website, and the broad device coverage amplifies the reach. Organizations should not discount this as low priority merely because it is 'Medium'—context matters.

Frequently asked questions