CVE-2026-112651
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
Risk Assessment
An attacker could use a malicious website to execute arbitrary code in the browser context. This may lead to device compromise or data leakage.
Recommendation
Update Safari to version 27.2 and systems to: iOS 26.7.2/iPadOS 26.7.2, iOS 27.2/iPadOS 27.2, macOS Golden Gate 27.2, or visionOS 27.2. Avoid untrusted websites until patched.
Other vulnerabilities in Apple Safari/iOS/iPadOS/macOS/visionOS
See all- CVE-2026-86986Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management in Safari and Apple platforms (iOS, iPadOS, macOS, visionOS). Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-86974Low risk· EPSS 9%
A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to memory corruption. The issue affects Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
- CVE-2026-112695Low risk· EPSS 9%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112693Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-112659High
A type confusion issue was addressed with improved memory handling. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112654Low risk· EPSS 8%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112653Low risk· EPSS 9%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112639High
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112623High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112621Low risk· EPSS 14%
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted image may result in memory corruption.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS