CVE-2025-46299

MEDIUM

Safari < 26.2 - Information Disclosure via Memory Initialization Issue

Title source: llm

Description

A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may disclose internal states of the app.

References (6)

Core 6

Core References

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125884

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125886

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125889

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125890

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125891

Release Notes, Vendor Advisory

https://support.apple.com/en-us/125892

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 8.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (13)

Apple/iOS and iPadOS < 26.2

apple/ipados < 26.2

apple/iphone_os < 26.2

apple/macos < 26.2

Apple/macOS < 26.2

apple/safari < 26.2

Apple/Safari < 26.2

apple/tvos < 26.2

Apple/tvOS < 26.2

apple/visionos < 26.2

... and 3 more

Published Jan 09, 2026

Tracked Since Feb 18, 2026