The WebKitGTK rendering engine can corrupt memory when it processes maliciously crafted web content. This flaw, cataloged as CWE-416 (Use After Free) and potentially associated with CWE-352, results in undefined behavior that can crash the web process. The CVE statement does not mention a confirmed remote code execution path, so the impact is limited to memory corruption and potential process instability.

The affected platforms are Apple products that bundle Safari or WebKitSDK: macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. Versions prior to the fixed releases—Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5—contain the flaw. The issue is tracked by Apple; no other vendors are listed as affected in the CNA data. Additionally, Red Hat Enterprise Linux distributions that ship WebKitGTK—including Enterprise Linux 8 and 9, RHEL 8.2, 8.4, 8.6, as well as RHEL 8.4, 8.6, 9.0 in the aus, e4s, tus and els support streams—are also affected, though no specific patch information is provided in the CNA data.

The CVSS score of 8.0 classifies this as high severity, yet the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a user visiting or rendering malicious web content rendered by WebKitGTK. This inferred attack path could lead to memory corruption and application crashes, and may provide a foothold for further exploitation, although no concrete RCE pathway is documented.