Description

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-17T22:17:11.457Z",
  "pubdate": "2026-08-17T22:17:11.457Z",
  "executiveSummary": "A memory corruption vulnerability exists across multiple Apple operating systems, specifically impacting iOS, iPadOS, and macOS. The flaw arises from inadequate memory handling mechanisms during the processing of maliciously crafted web content. Successful exploitation of this vulnerability can lead to memory corruption, potentially resulting in arbitrary code execution or application crashes.\nThe affected products and versions include iOS and iPadOS versions prior to 18.7.10 and 26.6.1, alongside macOS Tahoe versions prior to 26.6.2. The risk implications are severe, as an attacker capable of delivering a specially crafted web page or malicious web content can compromise the integrity and availability of the targeted system upon successful parsing and rendering.\nExploitation requirements typically involve user interaction, such as enticing a target to navigate to a malicious website or view crafted web content via vulnerable applications that process web streams. The attacker capabilities include leveraging memory safety weaknesses to disrupt standard execution flows or achieve further system compromise, highlighting the necessity of timely firmware and operating system updates.",
  "technicalDetails": "The vulnerability is fundamentally rooted in improper memory handling within the subsystems responsible for rendering and parsing web content. Insufficient bounds checking, improper pointer arithmetic, or flawed lifecycle management of dynamic memory allocations allows malformed inputs within web payloads to trigger out-of-bounds reads or writes, heap corruption, or use-after-free conditions.\nThe attack flow begins when a user accesses maliciously crafted web content, which can be delivered via compromised websites, malicious advertisements, or embedded web views within applications. As the vulnerable component parses the complex structures within the web content, the anomalous data triggers the memory corruption flaw due to the lack of strict input sanitization and robust memory validation routines.\nUpon successful triggering of the vulnerability, the internal memory state of the affected process is corrupted. Depending on the specific nature of the memory corruption primitive achieved, an attacker can manipulate application control flow registers or overwrite critical data structures in memory. This can transition into arbitrary code execution within the context of the running process, potentially bypassing standard security mitigations if proper isolation is not enforced.\nThe vulnerability affects iOS and iPadOS 18.7.10 and 26.6.1, as well as macOS Tahoe 26.6.2, where enhanced memory handling routines were introduced to resolve the issue. Network exposure is present whenever the device processes untrusted web traffic, and exploitation can theoretically occur remotely without prior authentication or elevated privileges, provided the victim processes the malicious web content."
}