CVE-2026-43717: Safari Use-After-Free Crash Vulnerability – Patch Guidance

Technical summary

CVE-2026-43717 is a use-after-free vulnerability (CWE-416) in Safari's web content processing engine. Use-after-free occurs when a program references memory after it has been deallocated, leading to undefined behavior. In this case, improper memory management during the handling of crafted HTML or JavaScript allows an attacker to trigger a crash. The vulnerability is network-accessible and requires no elevated privileges, but user interaction is necessary—the user must view the malicious content in Safari. The CVSS 3.1 score of 6.5 (MEDIUM) reflects high availability impact with no confidentiality or integrity consequences.

Business impact

This vulnerability creates availability risk for organizations where Safari is a primary or supported browser. The crash is disruptive but not data-exfiltrating. In environments where employee workflows depend on Safari (financial services, design, publishing), repeated crashes from targeted or opportunistic malicious sites could reduce productivity. The vulnerability does not pose direct data breach or compliance violation risk, but persistent exploitation could support harassment or denial-of-service campaigns against specific users or organizations. Overall business impact is moderate unless Safari is mission-critical in your environment.

Affected systems

The vulnerability affects Safari on macOS Tahoe, Safari on iOS, Safari on iPadOS, tvOS running Safari, and watchOS. Specifically, the following versions prior to patching are vulnerable: Safari 26.5.2 and earlier, iOS earlier than 26.5.2, iPadOS earlier than 26.5.2, macOS Tahoe earlier than 26.5.2, tvOS earlier than 26.6, and watchOS earlier than 26.6. No Android, Windows, or Linux platforms are affected. The scope is limited to Apple's ecosystem.

Exploitability

Exploitability is moderate. The vulnerability is network-accessible and requires no special network conditions (low attack complexity). However, it mandates user interaction—the victim must visit the attacker's web page or click a link to malicious content. This is a realistic but not automatic attack vector; social engineering or advertising injection could lower the barrier. There is no evidence of active exploitation in the wild (CVE-2026-43717 has not been added to the CISA KEV catalog). Exploit development is likely straightforward for capable threat actors, but public weaponized code is not known.

Remediation

Patch all affected Apple products immediately. For end users: update Safari to 26.5.2 or later, iOS to 26.5.2 or later, iPadOS to 26.5.2 or later, macOS Tahoe to 26.5.2 or later, tvOS to 26.6 or later, and watchOS to 26.6 or later. Most users can enable automatic updates to receive fixes without manual intervention. For organizations, validate patching status through mobile device management (MDM) or endpoint tools, enforce minimum OS versions, and communicate update timelines to users. No workaround exists other than avoiding untrusted web content or using an alternative browser.

Patch guidance

Apply updates as follows: Safari users on macOS should update to Safari 26.5.2. iPhone and iPad users should update to iOS 26.5.2 and iPadOS 26.5.2 respectively. Apple TV users should update to tvOS 26.6. Apple Watch users should update to watchOS 26.6. For IT teams managing Apple devices, push these updates through MDM policies and confirm deployment through inventory management. Prioritize devices used for sensitive or business-critical functions. Most patches are cumulative; older OS versions should be updated to the latest available release. Verify patch application by checking Settings > [Device Name] > About or System Preferences > About This Mac.

Detection guidance

Monitor for unexpected Safari crashes or hangs in application logs and system event logs. On macOS, check ~/Library/Logs and Console.app for Safari crashes with memory-related stack traces. On iOS/iPadOS, enable crash reporting in Settings > Privacy > Analytics and aggregate crash data. Intrusion detection systems should flag unexpected visits to suspicious or newly registered domains combined with Safari crashes on the same endpoint. Web proxy logs can identify which URLs led to crashes if correlation is performed. Note that crashes alone are not malicious—pair detection with threat intelligence about known watering-hole sites or attacker infrastructure.

Why prioritize this

Prioritize based on Safari adoption in your organization. If Safari is a standard browser for significant user populations (especially in creative or financial sectors), patch within 2 weeks. If Safari is rare or used only as a secondary browser, patching remains important but can be scheduled within a standard quarterly cycle, provided users are counseled to avoid untrusted sites in the interim. The MEDIUM CVSS score and lack of KEV listing indicate this is not a critical emergency, but the low attack complexity and user-interaction dependency make it a realistic risk for targeted campaigns.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network Accessibility (AV:N)—attackers can exploit remotely via the internet; (2) Low Attack Complexity (AC:L)—no special conditions needed; (3) No Privileges Required (PR:N)—unauthenticated access; (4) User Interaction Required (UI:R)—victim must view content, reducing severity; (5) High Availability Impact (A:H)—repeated crashes disable the browser; (6) No Confidentiality or Integrity Impact (C:N, I:N)—no data is stolen or corrupted. The MEDIUM severity appropriately reflects a real but limited threat; it is not critical because it does not compromise data or system integrity, only availability.

Frequently asked questions