CVE-2026-43745: Safari Out-of-Bounds Write Vulnerability – Patch Guidance

Technical summary

CVE-2026-43745 is an out-of-bounds write vulnerability (CWE-787) in Apple's WebKit rendering engine, affecting Safari and its embedded use in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw stems from insufficient input validation during web content processing. An attacker can craft malicious HTML, JavaScript, or media content to trigger a heap or stack buffer overflow, causing the browser process to crash. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the availability impact without confidentiality or integrity compromise in the attack vector.

Business impact

This vulnerability primarily causes denial of service—users experience unexpected Safari crashes while browsing. For organizations where Safari is a business-critical browser (particularly in Apple-centric enterprises), widespread exploitation could degrade productivity. The crashes may also be weaponized as a distraction or smokescreen during targeted attacks. There is no evidence of data exfiltration or account compromise from this flaw alone.

Affected systems

Apple Safari (desktop), Apple iOS, Apple iPadOS, Apple macOS, tvOS, visionOS, and watchOS are affected. Patch versions are Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. All versions prior to these releases remain vulnerable. The vulnerability crosses consumer and enterprise deployment scenarios given Safari's ubiquity in Apple's ecosystem.

Exploitability

Exploitation requires user interaction (browsing to a malicious website) but no special privileges or authentication. The attack vector is network-based with low complexity, making it accessible to threat actors with basic web development skills. However, the flaw is not known to be actively exploited in the wild, and no public exploit code has been disclosed. Attackers would need to host or inject malicious content into a trusted domain to achieve reasonable success rates.

Remediation

Apply the vendor-supplied patches immediately: Safari 26.5.2 and later, iOS 26.5.2 and later, iPadOS 26.5.2 and later, macOS Tahoe 26.5.2 and later, tvOS 26.6 and later, visionOS 26.6 and later, and watchOS 26.6 and later. Verify patch installation across all Apple devices in your environment, especially mobile devices that may not auto-update. Consider deploying mobile device management (MDM) policies to enforce timely updates.

Patch guidance

Patches are available through standard Apple Software Update channels. For macOS, navigate to System Settings > General > Software Update. For iOS and iPadOS, use Settings > General > Software Update. Enterprise deployments should use Apple's Device Enrollment Program (DEP) and MDM solutions to push updates to all managed devices. Verify patch installation within 30 days of release to minimize the window of exposure.

Detection guidance

Monitor for unexpected Safari process crashes or syslog entries indicating WebKit memory violations. On macOS, check ~/Library/Logs/DiagnosticMessages/ for Safari crash reports. Mobile device management logs can show patch compliance. Network-based detection is limited since the payload is embedded in web content; however, intrusion detection systems may flag attempts to serve known malicious payloads if signatures are available. End-user education about avoiding suspicious links reduces attack surface.

Why prioritize this

Although CVSS 6.5 is labeled MEDIUM, the combination of broad product reach (all Apple platforms), ease of exploitation (user interaction only), and direct availability impact warrant rapid patching. Organizations with high Safari adoption should treat this as high priority. The lack of KEV listing or known active exploitation provides some breathing room, but patch deployment should still occur within 2–4 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity attack requiring user interaction, with high availability impact but no confidentiality or integrity loss. The score underweights organizational risk for Apple-centric environments and supply chain scenarios where browser crashes could trigger cascading failures. Risk is elevated in zero-trust or high-assurance settings where unexpected crashes may trigger security lockdowns.

Frequently asked questions