Improved state management was required to address an issue in WebKitGTK where maliciously crafted web content could trigger an unexpected process crash. The vulnerability involves memory‑handling weaknesses, as indicated by CWE-119 (Buffer Overflow) and CWE-125 (Out‑of‑Bounds Read). A successful exploitation would cause the WebKit engine to terminate, resulting in a denial of service for any application or web page rendering that content.

Apple users running Safari, iOS, iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS are impacted on releases earlier than Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. The vulnerability is also present on Red Hat Enterprise Linux 8 and 9 platforms as denoted by the associated CPE strings, though specific affected RHEL releases are not enumerated in the advisory.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of 1% suggests a low but non‑zero likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is personal or network‑based delivery of maliciously crafted web content rendered by a vulnerable WebKitGTK instance. An attacker would need to cause a user to visit a site or supply crafted web assets that trigger the crash, leading to denial of service for that user or for other processes relying on WebKit.