CVE-2026-43745

Think of Safari as a program that reads information from websites. This bug is like a mistake in how it writes temporary data while reading a dangerous, specially crafted web page—so Safari can hit an error and crash. In real life, that mainly means disruption (your browser session falls over), not data theft.

This matters if your business uses Safari on Mac, iPhone, or iPad—especially if staff regularly browse the web, click links in emails, or use Safari for work apps. The weakness does not require a login from the attacker, but it does require user interaction (someone must open the malicious web content). Whether it’s reachable in your “default configuration” isn’t confirmed in the findings, so the practical risk is highest anywhere Safari can be used to view untrusted web pages.

Treat this as an update-quickly item, but not a “panic now” emergency. Attackers can trigger it via network-delivered malicious web content, and it can cause an unexpected crash, but there’s no evidence in the provided findings of active exploitation in the wild. Given the fix is already available in 26.5.2 for all affected platforms, schedule updates promptly.

1. Identify affected versions across your fleet

   • On Macs: check macOS version; confirm you’re on macOS Tahoe 26.5.2.
   • On iPhones/iPads: check iOS/iPadOS version; confirm you’re on iOS 26.5.2 and iPadOS 26.5.2.
   • This CVE’s fix is present only in those versions (Safari 26.5.2 / iOS 26.5.2 / iPadOS 26.5.2 / macOS Tahoe 26.5.2).

2. Confirm exposure and practical risk

   • Exposure is primarily through browsing: the findings say the attack vector is network-delivered web content.
   • Because user interaction is required, the risk is tied to situations where employees open untrusted or potentially malicious web pages.
   • The findings do not confirm whether it’s reachable in the default configuration, so use your normal browsing/mail/link-trusting patterns to gauge risk.

3. Upgrade to the fixed releases

   • Upgrade in this order where possible:
     1. macOS Tahoe devices to macOS Tahoe 26.5.2
     2. iPhones to iOS 26.5.2
     3. iPads to iPadOS 26.5.2
     4. Ensure Safari updates are included via the OS update (Safari 26.5.2)

4. Temporary workaround if you can’t patch immediately

   • Reduce exposure by limiting access to untrusted websites (for example, tighten “allowed domains” in any internal browsing tools, and caution staff about clicking unexpected links).
   • Avoid opening unknown links received via email/chat until devices are updated.
   • This doesn’t eliminate the bug, but it lowers the chance staff interact with malicious web content.

5. What to monitor after patching

   • Look for recurring Safari crashes and browser restarts reported by users.
   • If crashes persist after updating to 26.5.2, collect the time of crash and affected device model/OS version to investigate other causes.

CVE-2026-43745 addresses a CWE-787 out-of-bounds write in Safari that occurs while processing maliciously crafted web content, resulting in an unexpected crash.

Key findings-backed points:

• Authentication is not required to trigger the condition.
• User interaction is required (someone must open the malicious content in Safari).
• Attack vector is network (malicious web content).
• Confirmed impact in the findings is an unexpected crash (availability impact), not confirmed data exposure.
• No KEV listing and no clear dated press exploitation claim were provided, and there is no public exploit code on record in the findings.

Fix availability:

• The vulnerability is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 (per the provided patch findings).