CVE-2026-43712: Apple Safari DOS Vulnerability

CVE-2026-43712 Overview

CVE-2026-43712 is an out-of-bounds read vulnerability [CWE-125] affecting Apple Safari, iOS, iPadOS, and macOS. The flaw resides in WebKit's memory handling logic when processing web content. An attacker who convinces a user to visit a maliciously crafted webpage can trigger an unexpected process crash. Apple addressed the issue with improved memory handling in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Exploitation requires user interaction and does not compromise confidentiality or integrity, but it disrupts availability of the browsing process.

Critical Impact
Processing maliciously crafted web content may lead to an unexpected process crash across Safari, iOS, iPadOS, and macOS.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43712 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43712

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in Apple's WebKit engine. WebKit reads memory outside the bounds of an allocated buffer while parsing or rendering crafted web content. The invalid read corrupts execution state and causes the affected process to terminate unexpectedly. The bug affects the shared WebKit component used by Safari and by the system web view on iOS, iPadOS, and macOS.

Root Cause

Apple's advisory attributes the defect to improper memory handling within WebKit. The fix introduces stricter boundary validation, indicating that prior code paths failed to verify buffer limits before dereferencing memory. The precise function and code region were not disclosed in Apple's public advisories.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page or injects crafted content into a compromised site. When a user opens the page in an affected browser or embedded web view, WebKit performs the out-of-bounds read and crashes the tab or application process. The impact is limited to availability; the vector does not expose sensitive data or allow code execution based on the disclosed information.

Apple has not published proof-of-concept code, and no public exploit is available. The EPSS probability at disclosure was 0.202%, reflecting low observed exploitation likelihood. See the Apple Security Advisory 127594 for vendor-published technical context.

Detection Methods for CVE-2026-43712

Indicators of Compromise

Repeated Safari or WebKit process crashes correlated with visits to untrusted URLs.
Crash reports referencing WebKit memory access faults on iOS, iPadOS, or macOS endpoints.
Application crash logs generated by com.apple.WebKit.WebContent processes shortly after web navigation events.

Detection Strategies

Collect and centralize macOS and iOS crash reports, then filter for WebContent and Safari process terminations tied to web browsing sessions.
Correlate endpoint browser telemetry with DNS or proxy logs to identify users landing on suspicious domains before crash events.
Track Safari and OS version inventory to identify endpoints running builds earlier than 26.5.2.

Monitoring Recommendations

Ingest MDM and endpoint telemetry into a SIEM or data lake to flag devices missing the 26.5.2 update.
Alert on abnormal spikes in WebKit process crashes across managed fleets.
Monitor threat intelligence feeds for emerging WebKit proof-of-concept publications tied to this CVE.

How to Mitigate CVE-2026-43712

Immediate Actions Required

Update Safari to 26.5.2 on macOS endpoints and confirm the version through Safari > About Safari.
Upgrade iOS and iPadOS devices to 26.5.2 through MDM policy or user-initiated update.
Upgrade macOS Tahoe systems to 26.5.2 and validate patch state across managed devices.

Patch Information

Apple released fixed versions in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to the Apple Security Advisory 127594, Apple Security Advisory 127595, and Apple Security Advisory 127685 for exact build numbers and applicability.

Workarounds

Restrict browsing to trusted sites until patching is complete, since exploitation requires user-initiated navigation.
Deploy content filtering or secure web gateways to block known malicious domains that may host crafted WebKit payloads.
Enforce MDM configuration profiles that prevent installation of unmanaged browsers relying on outdated WebKit builds.

bash

# Configuration example: verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Force macOS software update check via MDM or terminal
sudo softwareupdate --install --all --restart