An out‑of‑bounds write in WebKitGTK allows maliciously crafted web content to breach the Web Content sandbox, giving an attacker the ability to execute code with the privileges of the host process. The failure of the boundary checks could therefore lead to arbitrary code execution or privilege escalation when rendering unsuspecting web pages.

The flaw is present in Apple’s WebKit-based products: Safari, iOS, iPadOS, macOS, visionOS, and watchOS in the versions listed by Apple. It also affects Linux distributions that ship the WebKitGTK runtime, notably RedHat Enterprise Linux 8 and 9 and several extended‑service variants, as the CPE list indicates. These systems expose the vulnerable component through standard web‐content rendering paths, including browsers, built‑in web views, and any application that embeds WebKitGTK.

With a CVSS score of 10, the vulnerability is classified as critical, and an EPSS score of less than 1% indicates low predicted exploitation frequency at this time. Nevertheless, the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that it has been actively leveraged by attackers. The likely attack vector involves delivering specially crafted web content—through a website, malicious email attachment, or any other channel that renders web pages—to a user’s device, where the web process can escape the sandbox and run arbitrary code.