Improper input validation in Safari’s content parser causes a crash when processing maliciously crafted web pages. The flaw, classified as CWE‑20, does not enable code execution or data exposure; it merely destabilizes the browser, resulting in a denial of service for the user. The crash leaves no direct avenue for attackers to gain control but does allow disruption of browsing sessions and could be leveraged for high‑profile targeted attacks.

Apple Safari on macOS 15.5 (Sequoia), iOS 18.5, iPadOS 18.5 and 17.7.7, tvOS 18.5, visionOS 2.5, and watchOS 11.5 are affected. The vulnerability applies to Safari 18.5 and earlier releases on these operating systems.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation opportunities are rare at the current time, and the vulnerability is not listed in CISA’s KEV catalog. Likely, an attacker would need to entice a user to visit a specially crafted web page, possibly via phishing or compromised sites, to trigger the crash. While local impact is limited to the affected device, repeated crashes could impair user productivity or serve as a foothold for more complex attacks if coupled with other vulnerabilities.