ZDI-CAN-29186: ZDI-26-313: Apple Safari Regular Expression Duplicate Named Groups Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of regular expression named groups. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-28847.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apple Safarito a version that resolves this vulnerability.Patch ZDI-26-313 - Compensating control
Because user interaction is required (the target must visit a malicious page or open a malicious file), reduce exposure by restricting browsing to trusted sites and treating unsolicited/malicious files or links as untrusted until Safari is updated.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-29186?
ZDI-CAN-29186 has a critical severity due to its potential for remote code execution.
How do I fix ZDI-CAN-29186?
To mitigate ZDI-CAN-29186, users should update Apple Safari to the latest version released by Apple.
What types of exploits are possible with ZDI-CAN-29186?
ZDI-CAN-29186 can be exploited to perform arbitrary code execution on affected systems.
What versions of Apple Safari are affected by ZDI-CAN-29186?
ZDI-CAN-29186 affects all installations of Apple Safari prior to the security update that addresses this vulnerability.
Is user interaction required to exploit ZDI-CAN-29186?
Yes, user interaction is required to successfully exploit ZDI-CAN-29186.