webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

cve CVE-2026-84635 2 sources, 2 claims · Watch

Red Hat writes:
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination the claim

Severity they disagree: MEDIUM NVD
important Red Hat
CVSS they disagree: 6.5 NVD
8.8 Red Hat
Fixed in: 27 NVD
Vendor: Apple NVD
Product: Safari NVD
CWE: CWE-843 NVD
CWE-664 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	network N	network N
Attack complexity AC	low L	low L
Privileges required PR	low L	none N
User interaction UI	none N	required R
Scope S	unchanged U	unchanged U
Confidentiality C	none N	high H
Integrity I	none N	high H
Availability A	high H	high H

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2026-09-14	first spoke of it: A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.	NVD
2026-09-14	first spoke of it: webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination	Red Hat

What it is to other things

affects	apple/ipados NVD
affects	apple/iphone_os NVD
affects	apple/macos NVD
affects	apple/safari NVD
affects	apple/tvos NVD
affects	apple/visionos NVD
affects	apple/watchos NVD
made_by	apple NVD

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	no
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

NVD

6.5

receipt

Source: NVD
Its words: 6.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

Red Hat

8.8

receipt

Source: Red Hat
Its words: 8.8
Read by: field:cvss3_score
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-84635",
  "CWE": "CWE-664",
  "advisories": [
    "RHSA-2026:69098",
    "RHSA-2026:74084"
  ],
  "affected_packages": [
    "webkit2gtk3-0:2.54.0-1.el9_8",
    "webkit2gtk3-0:2.54.0-1.el8_10"
  ],
  "bugzilla": "2535531",
  "bugzilla_description": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination",
  "cvss3_score": "8.8",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-14T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84635.json",
  "severity": "important"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2026-09-29 09:44 UTC	—

What the source handed over

{
  "CVE": "CVE-2026-84635",
  "CWE": "CWE-664",
  "advisories": [
    "RHSA-2026:69098",
    "RHSA-2026:74084"
  ],
  "affected_packages": [
    "webkit2gtk3-0:2.54.0-1.el9_8",
    "webkit2gtk3-0:2.54.0-1.el8_10"
  ],
  "bugzilla": "2535531",
  "bugzilla_description": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination",
  "cvss3_score": "8.8",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-14T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84635.json",
  "severity": "important"
}

—

CWE

cwe

different words

NVD

CWE-843

receipt

Source: NVD
Its words: CWE-843
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CWE-843
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

different words

Red Hat

CWE-664

receipt

Source: Red Hat
Its words: CWE-664
Read by: field:CWE
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-84635",
  "CWE": "CWE-664",
  "advisories": [
    "RHSA-2026:69098",
    "RHSA-2026:74084"
  ],
  "affected_packages": [
    "webkit2gtk3-0:2.54.0-1.el9_8",
    "webkit2gtk3-0:2.54.0-1.el8_10"
  ],
  "bugzilla": "2535531",
  "bugzilla_description": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination",
  "cvss3_score": "8.8",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-14T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84635.json",
  "severity": "important"
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	none
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Fixed in

fixed_in

NVD

receipt

Source: NVD
Its words: 27
Read by: field:cve.affected[].affectedData[].versions[status=affected].lessThan
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	27
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Packages

packages

Red Hat

webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10

receipt

Source: Red Hat
Its words: webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10
Read by: field:affected_packages[]
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10
2026-09-29 09:44 UTC	webkit2gtk3-0:2.54.0-1.el9_8

What the source handed over

{
  "CVE": "CVE-2026-84635",
  "CWE": "CWE-664",
  "advisories": [
    "RHSA-2026:69098",
    "RHSA-2026:74084"
  ],
  "affected_packages": [
    "webkit2gtk3-0:2.54.0-1.el9_8",
    "webkit2gtk3-0:2.54.0-1.el8_10"
  ],
  "bugzilla": "2535531",
  "bugzilla_description": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination",
  "cvss3_score": "8.8",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-14T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84635.json",
  "severity": "important"
}

—

Product

product

NVD

Safari

receipt

Source: NVD
Its words: Safari
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Safari
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

conflict

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	MEDIUM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

medium

Severity

severity

conflict

Red Hat

important

A flaw that can easily compromise confidentiality, integrity or availability.

receipt

Source: Red Hat
Its words: important
Read by: field:severity
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-84635",
  "CWE": "CWE-664",
  "advisories": [
    "RHSA-2026:69098",
    "RHSA-2026:74084"
  ],
  "affected_packages": [
    "webkit2gtk3-0:2.54.0-1.el9_8",
    "webkit2gtk3-0:2.54.0-1.el8_10"
  ],
  "bugzilla": "2535531",
  "bugzilla_description": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination",
  "cvss3_score": "8.8",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-14T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84635.json",
  "severity": "important"
}

high

Status

status

NVD

Analyzed

receipt

Source: NVD
Its words: Analyzed
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	partial
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Apple

receipt

Source: NVD
Its words: Apple
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Apple
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Safari",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "iOS and iPadOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "macOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "tvOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "visionOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "product": "watchOS",
            "vendor": "Apple",
            "versions": [
              {
                "lessThan": "27",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "product-security@apple.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "56FD173B-C101-42F8-8087-AF09F2302BE8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6F43E9DC-5D72-4325-9965-E6B50054B8E8",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF",
                "versionEndExcluding": "27.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination."
      }
    ],
    "id": "CVE-2026-84635",
    "lastModified": "2026-09-18T13:06:43.063",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-84635",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-16T19:33:36.934407Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-14T21:17:38.260",
    "references": [
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149034"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149035"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149036"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149037"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149038"
      },
      {
        "source": "product-security@apple.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.apple.com/en-us/149039"
      }
    ],
    "sourceIdentifier": "product-security@apple.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-843"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination zetlyn/cve-redhat · 2026-09-14	cvss 8.8 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H cwe CWE-664 packages webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10 severity important	source
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination. zetlyn/cve-nvd · 2026-09-14	automatable no cvss 6.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H cwe CWE-843 exploitation none fixed_in 27 product Safari severity MEDIUM status Analyzed technical_impact partial vendor Apple	source