CVE-2026-43720

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.5.2 iOS versions prior to 18.7.10 iOS versions prior to 26.5.2 iPadOS versions prior to 18.7.10 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 PlayStation 5 Firmware version 14.10 WebKitGTK (affected versions not specified) Red Hat Enterprise Linux 6 (affected versions not specified)

Description A use-after-free issue exists due to improper memory management. This flaw can be triggered when processing maliciously crafted web content, potentially leading to an unexpected browser crash. In specific environments, such as the PlayStation 5, this can be exploited via a reentrant use-after-free in the getContext() function of the HTML5 <canvas> element. By using a JavaScript getter within the options of getContext('bitmaprenderer', opts), an attacker can cause the system to free a 768-byte 2D context while a JavaScript wrapper remains resident, creating a dangling pointer. This allows for bidirectional memory aliasing, enabling an attacker to read and write state properties such as lineWidth, miterLimit, globalAlpha, fillStyle, and transform. Additionally, in WebKitGTK, this and related security issues could allow a remote attacker to perform cross-site scripting (XSS), denial of service (DoS), and arbitrary code execution if a user is tricked into visiting a malicious website.

Recommendations Update Safari to version 26.5.2. Update iOS to version 18.7.10 or 26.5.2. Update iPadOS to version 18.7.10 or 26.5.2. Update macOS Tahoe to version 26.5.2. Update tvOS to version 26.6. Update visionOS to version 26.6. Update watchOS to version 26.6. Update PlayStation 5 firmware to a version newer than 14.10. Upgrade WebKitGTK to a vendor-listed fixed release. Upgrade Red Hat Enterprise Linux 6 to a vendor-listed fixed release.