CVE-2026-112659
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A type confusion issue was addressed with improved memory handling. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
Risk Assessment
An attacker could trick a user into visiting a malicious website, potentially leading to arbitrary code execution in the browser context. This poses a risk to browsing security and user data.
Recommendation
Update Safari to version 27.2 and systems to: iOS 26.7.2/iPadOS 26.7.2, iOS 27.2/iPadOS 27.2, macOS Golden Gate 27.2, or visionOS 27.2. Avoid visiting untrusted websites until patched.
Other vulnerabilities in Apple Safari/iOS/iPadOS/macOS/visionOS
See all- CVE-2026-86986Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management in Safari and Apple platforms (iOS, iPadOS, macOS, visionOS). Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-86974Low risk· EPSS 9%
A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to memory corruption. The issue affects Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
- CVE-2026-112695Low risk· EPSS 9%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112693Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-112654Low risk· EPSS 8%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112653Low risk· EPSS 9%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112651High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112639High
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112623High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112621Low risk· EPSS 14%
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted image may result in memory corruption.
Original NVD description (English source)
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS