CVE-2026-28942
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A use-after-free vulnerability was addressed with improved memory management in Safari. The issue is fixed in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Risk Assessment
The risk involves remote triggering of a Safari crash by delivering malicious web content to the user, potentially disrupting operations and enabling further attacks.
Recommendation
It is recommended to immediately update Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) to the latest versions mentioned in the description to eliminate the vulnerability.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.