Skip to content
OpenAdvisories
High · 8.8 CVE-2026-64757 EUVD-2026-49438GHSA-92wj-cv26-9fx4

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10,…

Published Jul 27, 2026 · Updated Aug 17, 2026 · Assigned by apple

Vendor: Apple Product: iOS and iPadOS Product: macOS Product: Safari Product: visionOS Product: watchOS Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkit2gtk Package: webkit2gtk Package: webkitgtk Package: wpewebkit Package: wpewebkit Platform: iOS Platform: macOS Category: Browsers Ecosystem: Debian Ecosystem: Ubuntu

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Affected products

VendorProductAffectedFixed
Apple Safari < 26.6 26.6
Apple iOS and iPadOS < 18.7.10, < 26.6 18.7.10
Apple macOS < 26.6 26.6
Apple visionOS < 26.6 26.6
Apple watchOS < 26.6 26.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 wpewebkit +1 2.52.6-1 —
Debian 13 webkit2gtk 2.52.6-1~deb13u1 —
Debian 13 wpewebkit No fix yet —
Debian 12 wpewebkit +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS webkit2gtk 2.52.6-0ubuntu0.26.04.1 USN-8703-1
Ubuntu 24.04 LTS qtwebkit-opensource-src No fix yet —
Ubuntu 24.04 LTS webkit2gtk 2.52.6-0ubuntu0.24.04.1 USN-8703-1
Ubuntu 22.04 LTS wpewebkit +2 No fix yet —
Ubuntu 20.04 LTS wpewebkit +2 No fix yet —
Ubuntu 18.04 LTS webkitgtk +3 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS webkitgtk +3 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 webkit2gtk3 +3 2.54.0-1.el9_8 RHSA-2026:69098
RHEL 8 webkit2gtk3 +3 2.54.0-1.el8_10 RHSA-2026:74084

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 webkit2gtk3 +3 2.54.0-1.el9_8 ALSA-2026:69098
AlmaLinux 8 webkit2gtk3 +3 2.54.0-1.el8_10 ALSA-2026:74084

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 webkit2gtk3 2.54.0-1.el9_8 RLSA-2026:69098
Rocky Linux 8 webkit2gtk3 2.54.0-1.el8_10 RLSA-2026:74084

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 webkit2gtk3 +2 2.52.6-150600.12.74.1 SUSE-SU-2026:4020-1
SLES 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 webkit2gtk3 +1 2.54.1-160000.1.1 SUSE-SU-2026:24225-1
SLES for SAP 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES for SAP 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES 16.0 webkit2gtk3 +1 2.54.1-160000.1.1 SUSE-SU-2026:24225-1
SLE HPC 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLE HPC 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 webkit2gtk3 +2 2.54.1-160000.1.1 openSUSE-SU-2026:22076-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 webkitgtk4 +3 2.52.6-1.amzn2 ALAS2-2026-3891

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 webkit2gtk3 +3 2.54.0-1.el9_8 ELSA-2026-69098
Oracle Linux 8 webkit2gtk3 +3 2.54.0-1.el8_10 ELSA-2026-74084

Advisories 22

References