A buffer overflow in WebKitGTK was identified when maliciously crafted web content is processed. The flaw allows an attacker to corrupt memory during parsing, potentially causing the browser or browser‑based application to crash. The crash provides a denial‑of‑service surface for the target system and may impact multiple users if the web content is rendered in a shared or multi‑tenant environment. The weakness is classified as CWE‑120, a classic stack‑based buffer overflow.

Affected Apple products include Safari, iOS, iPadOS, macOS Sequoia, tvOS, and watchOS. Versions that contain the vulnerability are Safari 18.4 and earlier, iOS 18.4 and earlier, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, and watchOS 11.4. Additionally, various Red Hat Enterprise Linux releases (RHEL 8, 9, and related extended support streams) are listed in the CPE data, suggesting that WebKitGTK derivatives on those platforms may also be affected, although no explicit patch level is supplied in the advisory.

The CVSS score of 7 indicates high severity, and the EPSS score of 3% shows a moderate likelihood that the vulnerability will be exploited in the near term. The flaw is not listed in CISA’s KEV catalog, so no known widely‑deployed exploit is documented. Based on the description, the attack vector is likely remote, originating from a web page containing crafted HTML or JavaScript that a user or process loads in a WebKitGTK‑based browser. An attacker could trigger the crash by tricking a user into visiting a malicious site or by compromising a site already trusted by the user.