CVE-2017-2491

CVE-2017-2491 is a critical use-after-free vulnerability in the String.replace method of JavaScriptCore, affecting Apple Safari on iOS versions prior to 10.3. This flaw allows remote attackers to execute arbitrary code on a vulnerable device simply by enticing a user to visit a crafted web page or open a malicious file. With a CVSS v3 score of 8.8 (HIGH), it presents a significant risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability compromise. While not listed on the KEV catalog or Hot List, an exploit (EDB-41964) is publicly available on ExploitDB, though there is no evidence of active widespread exploitation or significant community discussion.