The vulnerability arises from insufficient validation of maliciously crafted web content, resulting in memory corruption. This flaw can allow an attacker to corrupt process memory, potentially enabling the execution of arbitrary code or other compromise mechanisms. The weakness is categorized as CWE‑119, a classic buffer overrun scenario where unchecked data can overwrite important control structures in memory.

Apple products including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. The remediation patches are shipped in Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5.

The CVSS score of 7.3 indicates high severity, while the EPSS of 1% shows a moderate likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely deliver malicious web pages or use compromised Safari instances to trigger the buffer overflow, making the threat primarily web‑centric. Without the patch, attackers could exploit any device that renders untrusted web content.