CVE-2026-43658 is a memory handling vulnerability in Apple Safari that can lead to an unexpected crash when processing specially crafted web content. This affects Safari versions before 26.5 across various Apple operating systems. The vulnerability is classified under CWE-119 and CWE-120, indicating issues with improper memory operations. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to confidentiality (high). The issue has been fixed in Safari 26.5 and corresponding OS updates. Red Hat has released security advisories and patches for WebKitGTK+ to address this vulnerability on Red Hat Enterprise Linux Extended Life Cycle Support 7. No public exploits are known at this time.

Successful exploitation of this vulnerability may cause Safari to crash unexpectedly when processing malicious web content, potentially leading to denial of service and exposure of sensitive information due to memory handling flaws. The CVSS score indicates a high impact on confidentiality. There is no indication of integrity or availability impact beyond the crash. No known exploits are currently reported in the wild.

A fix is available in Safari 26.5 and corresponding updates for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS 26.5. Users and administrators should update affected Apple devices to these versions to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Life Cycle Support, updated WebKitGTK+ packages have been released and should be applied promptly. Patch status is confirmed by vendor advisories. No additional mitigation is indicated by the vendor advisories.