AI analysis
CVE-2026-64715 is a use-after-free (CWE-416) memory-safety flaw in Apple's web content processing stack, addressed with improved memory management in Safari 26.6.1, iOS/iPadOS 18.7.10 and 26.6.1, and macOS Tahoe 26.6.2. It is triggered when a user processes maliciously crafted web content — typically by visiting an attacker-controlled webpage in Safari or another WebKit-based view. Per Apple's advisory, a successful trigger leads to an unexpected process crash (denial of service), reflected in the CVSS score of 6.5 with availability-only impact, though the related Zero Day Initiative advisory (ZDI-26-610) characterizes the JavaScriptCore B3 ReduceStrength use-after-free as potentially leading to remote code execution. All users of the affected Safari, iOS, iPadOS, and macOS versions on Apple hardware are exposed until they apply the updates. There is currently no known exploitation in the wild, no public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.4% probability of exploitation in 30 days).
What to do: Update Safari to 26.6.1, iOS/iPadOS to 18.7.10 (older-branch devices) or 26.6.1 (current branch), and macOS Tahoe to 26.6.2. In the interim, avoid untrusted websites and ensure WebKit-based in-app browsers are patched via OS updates. Inventory Apple fleets for these versions and prioritize updates, monitoring for public PoCs given ZDI's characterization of the bug as potentially leading to remote code execution.
Affected
| apple Safari | versions prior to 26.6.1 |
| apple iPhone OS (iOS) | versions prior to 18.7.10 and versions prior to 26.6.1 (both supported update branches) |
| apple iPadOS | versions prior to 18.7.10 and versions prior to 26.6.1 (both supported update branches) |
| apple macOS (Tahoe) | versions prior to 26.6.2 |
Estimated exposure
mass≈1 billion+ users/devices (Safari and iOS/iPadOS active install base) — Apple's publicly reported active device base exceeds 2 billion and Safari's user base is on the order of a billion, so any WebKit flaw in current-branch releases plausibly exposes over a billion devices, though only those not yet updated…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash.