CVE-2026-86986
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A use-after-free issue was addressed with improved memory management in Safari and Apple platforms (iOS, iPadOS, macOS, visionOS). Processing maliciously crafted web content may lead to an unexpected Safari crash.
Risk Assessment
A malicious website could crash the browser, and in some cases a use-after-free may be exploited for code execution.
Recommendation
Update Safari and OS versions (Safari 27.2, iOS/iPadOS 26.7.2 or 27.2, macOS 27.2, visionOS 27.2). Avoid visiting untrusted websites until patched.
Other vulnerabilities in Apple Safari/iOS/iPadOS/macOS/visionOS
See all- CVE-2026-86974Low risk· EPSS 9%
A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to memory corruption. The issue affects Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
- CVE-2026-112695Low risk· EPSS 9%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112693Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-112659High
A type confusion issue was addressed with improved memory handling. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112654Low risk· EPSS 8%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112653Low risk· EPSS 9%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112651High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112639High
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112623High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112621Low risk· EPSS 14%
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted image may result in memory corruption.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS