CVE-2026-43742: Safari Use-After-Free Memory Vulnerability (CVSS 6.5)

Technical summary

This vulnerability exploits a use-after-free condition (CWE-416) in Safari's web content processing engine. A use-after-free occurs when code attempts to access memory that has already been freed, leading to undefined behavior and process termination. The attack vector is network-based with no privileges required; the user need only view crafted web content. The impact is limited to availability (denial of service via crash); confidentiality and integrity are not affected. Apple addressed this by improving memory lifecycle management in the affected components.

Business impact

End users may experience unexpected Safari crashes or app closures when browsing malicious websites, disrupting workflow and productivity. For organizations with large Mac, iPhone, or iPad deployments, unpatched systems represent a distributed denial-of-service risk from social engineering or drive-by attacks. However, because the impact is limited to availability and not data exfiltration or privilege escalation, business risk is moderate. The primary concern is user friction and support costs rather than data breach or system compromise.

Affected systems

The vulnerability affects Safari 26.5.1 and earlier, iOS 26.5.1 and earlier, iPadOS 26.5.1 and earlier, macOS Tahoe 26.5.1 and earlier, tvOS 26.5 and earlier, visionOS 26.5 and earlier, and watchOS 26.5 and earlier. Patched versions are Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Apple TV and Vision Pro devices are also in scope, expanding the attack surface beyond traditional computers and phones.

Exploitability

Exploitability is straightforward from an attacker perspective: no authentication or special privileges are needed, and the attack requires only that a user visit a malicious website or click a link. However, practical exploitation is limited to denial of service (crash), which is a lower-value attack compared to code execution. The CVSS score of 6.5 (Medium) reflects this trade-off—easy trigger, but limited impact. There is no current evidence of active exploitation in the wild, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the latest security updates for your Apple devices. Users and administrators should update to Safari 26.5.2 or later, iOS/iPadOS 26.5.2 or later, macOS Tahoe 26.5.2 or later, and tvOS/visionOS/watchOS 26.6 or later. Ensure automatic updates are enabled to receive patches as soon as they are released. Organizations managing fleets of macOS or iOS devices should verify patch compliance through mobile device management (MDM) or inventory tools.

Patch guidance

Patches are available through Apple's standard update channels. On iPhone and iPad, navigate to Settings > General > Software Update. On Mac, use System Preferences > Software Update. For enterprise environments, patches can be deployed through Apple Business Manager, Jamf, or other MDM solutions. Verify patch installation by checking Settings > About or System Preferences > About This Mac and confirming the version number matches the fixed release. Test updates on non-production devices first if your organization uses custom web applications.

Detection guidance

Monitor for unexpected Safari process crashes in your environment using system logs (Console on macOS, system logs on iOS via MDM analytics). Web traffic analysis is unlikely to reveal exploitation attempts, as the trigger is the user's viewing of malicious content. Endpoint detection tools may flag repeated crashes of Safari or WebKit processes. Focus detection efforts on inventory and patch compliance rather than behavioral signals, since the vulnerability leaves no persistent artifacts. Use MDM to verify patched versions across iOS and macOS fleets.

Why prioritize this

This vulnerability warrants timely but not emergency patching. The CVSS score of 6.5 (Medium severity) and lack of active exploitation reflect limited near-term risk. However, the ease of exploitation (user visits a website) and the broad user population affected by unpatched Safari versions justify treating it as a routine security maintenance priority. Organizations should patch within their standard monthly or quarterly cycle. Higher priority should be given to user-facing systems (personal devices, shared workstations) over isolated servers.

Risk score, explained

The 6.5 Medium severity score is driven by the network attack vector, low attack complexity, and requirement for user interaction, which lower the score from a potential 7.5+. The high availability impact (crash) is offset by the absence of confidentiality or integrity impact. If this vulnerability enabled remote code execution rather than denial of service, the score would exceed 8.5 (High). The absence of active exploitation and low real-world impact from crashes also support the Medium rating.

Frequently asked questions