PT-2026-39797 · Apple+1 · Safari+2

Dr3Dd + 3 · CVE-2026-28946 · Published 2026-05-11 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Safari versions prior to macOS Tahoe 26.5

Description A use-after-free issue, which occurs when a program continues to use a memory address after it has been freed, was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Recommendations Update to macOS Tahoe 26.5.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2026:25918

ALSA-2026:25927

CVE-2026-28946

OPENSUSE-SU-2026:21129-1

RHSA-2026:25918

SUSE-SU-2026:22203-1

SUSE-SU-2026:22212-1

SUSE-SU-2026:2376-1

SUSE-SU-2026:2378-1

SUSE-SU-2026:2623-1

Affected Products

Apple Macos

Rocky Linux

Safari

References · 102

• https://access.redhat.com/errata/RHSA-2026:25927 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25918 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2376-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:25918 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:28146 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22212-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2623-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22203-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:27785 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:27728 · Vendor Advisory
• https://support.apple.com/en-us/127115 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-25927.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21129-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:28147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28946 · Security Note