CVE-2026-39872

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Utkarsh Pal, Ignacio Sanmillan (@ulexec)

Attribute	Value
CVE	CVE-2026-39872
Bugzilla	313528
Component	WebCore
Bug Class	LogicError
Severity	medium
Commit	8912cf5b00c44e5c…
Advisory	Apple Advisory

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/Modules/webaudio/WaveShaperDSPKernel.cpp
• Source/WebCore/Modules/webaudio/WaveShaperNode.cpp
• Source/WebCore/Modules/webaudio/WaveShaperNode.h
• Source/WebCore/Modules/webaudio/WaveShaperProcessor.cpp
• Source/WebCore/Modules/webaudio/WaveShaperProcessor.h

Test Files

• LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash-expected.txt
• LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash.html