CVE-2026-86872 - Vulnerability Details - OpenCVE

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apple	Safari Visionos Watchos

No data.

No data.

References

Link	Providers
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149039

History

Tue, 20 Oct 2026 19:15:00 +0000

Type	Values Removed	Values Added
Title	Logic flaw in state management leading to unexpected behavior from malicious web content

Tue, 20 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-843
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Title		Logic flaw in state management leading to unexpected behavior from malicious web content
Weaknesses		CWE-787

Tue, 20 Oct 2026 04:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple safari Apple visionos Apple watchos
Vendors & Products		Apple Apple safari Apple visionos Apple watchos

Tue, 20 Oct 2026 01:15:00 +0000

Type	Values Removed	Values Added
Description		A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
References		https://support.apple.com/en-us/149037 https://support.apple.com/en-us/149038 https://support.apple.com/en-us/149039

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-10-20T00:50:44.084Z

Updated: 2026-10-26T20:37:33.025Z

Reserved: 2026-09-08T16:43:41.870Z

Link: CVE-2026-86872

Vulnrichment

Updated: 2026-10-20T15:12:53.363Z

NVD

Status : Awaiting Analysis

Published: 2026-10-20T01:17:25.357

Modified: 2026-10-20T16:17:15.347

Link: CVE-2026-86872

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86872", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2026-09-08T16:43:41.870Z", "datePublished": "2026-10-20T00:50:44.084Z", "dateUpdated": "2026-10-26T20:37:33.025Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing maliciously crafted web content may lead to unexpected behavior"}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "0", "status": "affected", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "27", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior."}], "references": [{"url": "https://support.apple.com/en-us/149037"}, {"url": "https://support.apple.com/en-us/149038"}, {"url": "https://support.apple.com/en-us/149039"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-10-26T20:37:33.025Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-843", "lang": "en", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T15:12:57.460534Z", "id": "CVE-2026-86872", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:13:01.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T15:12:57.460534Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:12:53.363Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/149037"}, {"url": "https://support.apple.com/en-us/149038"}, {"url": "https://support.apple.com/en-us/149039"}], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing maliciously crafted web content may lead to unexpected behavior"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-10-26T20:37:33.025Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86872", "state": "PUBLISHED", "dateUpdated": "2026-10-26T20:37:33.025Z", "dateReserved": "2026-09-08T16:43:41.870Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2026-10-20T00:50:44.084Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}