CVE-2026-28946

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-416

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Affected products

Apple macOS: from 26.0 before 26.5 — fixed in 26.5

How to fix

Upgrade to a fixed version: Apple macOS 26.5. Check the vendor advisory for mitigations.

References

https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127121
https://access.redhat.com/errata/RHSA-2026:25918
https://access.redhat.com/errata/RHSA-2026:25927
https://access.redhat.com/errata/RHSA-2026:27728
https://access.redhat.com/errata/RHSA-2026:27785
https://access.redhat.com/errata/RHSA-2026:27804
https://access.redhat.com/errata/RHSA-2026:28114
https://access.redhat.com/errata/RHSA-2026:28146
https://access.redhat.com/errata/RHSA-2026:28147
https://access.redhat.com/errata/RHSA-2026:28148
https://access.redhat.com/security/cve/CVE-2026-28946

Get alerted when CVE-2026-28946 or the next vulnerability affects your stack