This vulnerability arises from a type confusion bug in WebKitGTK that allows an attacker to write beyond intended bounds, leading to uncontrolled memory corruption. The CVSS score of 7.8 indicates that a successful exploitation could compromise system integrity, potentially allowing arbitrary code execution through corrupted memory areas. The flaw is identified as CWE-843, a type‑checking error that can be triggered by malformed input processed by WebKit.

Affected Apple products include Safari (18.5 and later), iOS (18.5), iPadOS (both 18.5 and 17.7.7), macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5. The advisory also lists cpe:/o:redhat:rhel_els:7, but no fix release has been published for that platform. Administrators should verify that all devices are running at least the minimum patched version for each platform.

Risk assessment shows a moderate severity CVSS of 7.8 combined with an EPSS of less than 1%, implying that few attacks are expected at this time. The vulnerability is not yet listed in CISA KEV, suggesting no known active exploits. Attackers would most likely target the vulnerability remotely through malicious web content or a compromised application that embeds WebKit, though the exact vector is not formally documented. Prompt patching reduces the likelihood that memory corruption can be leveraged for remote code execution.