CVE-2026-64718
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A use-after-free issue in the web content processing component was addressed with improved memory management. The flaw affects Safari, iOS, iPadOS, macOS Golden Gate, macOS Tahoe, tvOS, visionOS, and watchOS. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Risk Assessment
Users browsing malicious websites may experience Safari crashes, which could be leveraged for destabilizing attacks. The risk affects all Apple devices running vulnerable OS versions.
Recommendation
Update Safari, iOS, iPadOS, macOS Golden Gate, macOS Tahoe, tvOS, visionOS, and watchOS to the latest versions listed in the Apple security advisory. Prioritize applying updates on devices exposed to browsing untrusted content.
Other vulnerabilities in Apple Safari
See all- CVE-2015-5780High
The Safari Extensions implementation in Apple Safari before version 9 does not require user confirmation before replacing an installed extension, which may lead to unspecified impacts and attack vectors.
- CVE-2014-1303High
A heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism.
- CVE-2014-1300High
An unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors.
- CVE-2022-42856HighActively exploited
A type confusion issue in Safari, iOS, iPadOS, macOS, and tvOS. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of reports that this issue may have been actively exploited.
- CVE-2019-8506HighActively exploited
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-65391High
An out-of-bounds write vulnerability in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2026-65390High
An integer overflow vulnerability in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2026-43670High
A Content Security Policy bypass was addressed in AudioWorklet contexts in Safari and Apple operating systems. Processing maliciously crafted web content may bypass CSP.
- CVE-2026-65341Medium
A memory handling issue in the web content processing component was addressed with improved memory handling. The flaw affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2026-64787Medium
A use-after-free issue in the web content processing component was addressed with improved memory management. The flaw affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Processing maliciously crafted web content may lead to an unexpected process termination.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, visionOS 27, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS