The vulnerability resides in WebKitGTK’s handling of malformed web content, which can corrupt memory. A crafted payload may overwrite critical memory regions, potentially enabling an attacker to execute arbitrary code, gain unauthorized privileges, or crash the browser. This memory‑corruption flaw falls under buffer overrun, out‑of‑bounds read and write weaknesses (CWE‑119, CWE‑125, CWE‑787).

Apple Safari, iOS, iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS are known to be affected. The fix is deployed in Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5 or later. RedHat Enterprise Linux distributions that ship the unpatched WebKitGTK package are also listed in the CPE set, but the primary impact is on Apple platforms.

The CVSS score of 8.8 indicates a high‑severity flaw with a significant impact. The EPSS score of less than 1% implies a low probability of exploitation at this time, and the listing is not present in CISA’s KEV catalog. Attackers would leverage a remotely served webpage to trigger the bug; no local privileges or special preconditions are required beyond access to a vulnerable client. The memory corruption could lead to arbitrary code execution or denial of service, making the flaw a critical risk for end users.