{"id":"CVE-2026-20652","title":"The issue was addressed with improved memory handling","summary":"The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-400","CWE-120"],"vendor":"apple","product":"safari","affected":["safari < 26.3","ipados < 18.7.5","ipados >= 26.0, < 26.3","iphone_os < 18.7.5","iphone_os >= 26.0, < 26.3","macos < 26.3","visionos < 26.3"],"patched":["safari 26.3","ipados 26.3","iphone_os 26.3","macos 26.3","visionos 26.3"],"published":"2026-02-11","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20652","references":[{"url":"https://support.apple.com/en-us/126346","label":"product-security@apple.com"},{"url":"https://support.apple.com/en-us/126347","label":"product-security@apple.com"},{"url":"https://support.apple.com/en-us/126348","label":"product-security@apple.com"},{"url":"https://support.apple.com/en-us/126353","label":"product-security@apple.com"},{"url":"https://support.apple.com/en-us/126354","label":"product-security@apple.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:10702","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11329","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11814","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13845","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14659","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16056","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16695","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19206","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19535","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22136","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:9692","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-20652","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448793","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20652.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd"],"epss":0.00619,"epssPercentile":0.47978,"ingestedAt":"2026-07-03T18:53:52.409Z","slug":"CVE-2026-20652","body":"## Overview\n\nThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.\n\n## Affected\n\n- `safari < 26.3`\n- `ipados < 18.7.5`\n- `ipados >= 26.0, < 26.3`\n- `iphone_os < 18.7.5`\n- `iphone_os >= 26.0, < 26.3`\n- `macos < 26.3`\n- `visionos < 26.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `safari 26.3`\n- `ipados 26.3`\n- `iphone_os 26.3`\n- `macos 26.3`\n- `visionos 26.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}