CVE-2026-64715

CVE-2026-64715 is a use-after-free (CWE-416) memory-safety flaw in Apple's web content processing stack, addressed with improved memory management in Safari 26.6.1, iOS/iPadOS 18.7.10 and 26.6.1, and macOS Tahoe 26.6.2. It is triggered when a user processes maliciously crafted web content — typically by visiting an attacker-controlled webpage in Safari or another WebKit-based view. Per Apple's advisory, a successful trigger leads to an unexpected process crash (denial of service), reflected in the CVSS score of 6.5 with availability-only impact, though the related Zero Day Initiative advisory (ZDI-26-610) characterizes the JavaScriptCore B3 ReduceStrength use-after-free as potentially leading to remote code execution. All users of the affected Safari, iOS, iPadOS, and macOS versions on Apple hardware are exposed until they apply the updates. There is currently no known exploitation in the wild, no public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.4% probability of exploitation in 30 days).

What to do: Update Safari to 26.6.1, iOS/iPadOS to 18.7.10 (older-branch devices) or 26.6.1 (current branch), and macOS Tahoe to 26.6.2. In the interim, avoid untrusted websites and ensure WebKit-based in-app browsers are patched via OS updates. Inventory Apple fleets for these versions and prioritize updates, monitoring for public PoCs given ZDI's characterization of the bug as potentially leading to remote code execution.