CVE-2026-43707 is a memory corruption vulnerability in Apple Safari that may lead to an unexpected process crash when processing maliciously crafted web content. The issue was resolved by improving memory handling in Safari 26.5.2 and related OS versions (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS). The vulnerability does not impact confidentiality or integrity but can cause availability disruption through denial of service. There are no known exploits in the wild. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Successful exploitation of this vulnerability can cause an unexpected crash of the Safari process, resulting in denial of service. There is no impact on confidentiality or integrity. No known active exploits have been reported.

This issue is fixed in Safari 26.5.2 and corresponding updates to iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Users and administrators should apply these updates to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation is indicated.