The vulnerability resides in the WebKitGTK engine. Maliciously crafted web pages exploit a buffer overflow and overread flaw (CWE‑119 and CWE‑120) during memory management, causing arbitrary memory corruption. Although the description does not explicitly state code execution, memory corruption can allow an attacker to alter program state, crash the process, or potentially execute arbitrary code if the overflow is leveraged further.

Affected vendors include Apple and Red Hat. Apple products such as Safari, iOS, iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS are impacted. The identified patch releases are Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Red Hat Enterprise Linux 8 and 9, including their extended support streams (RHEL AUS, RHEL E4S, RHEL EUS, RHEL TUS) are also affected as the CPE list references numerous RHEL releases that embed the same engine.

The CVSS score of 8.8 reflects high severity. The EPSS score below 1 % indicates that, at the time of analysis, real‑world exploitation appears rare, yet the vulnerability is listed in the CISA KEV catalog, confirming that active exploits are known. Based on the description, it is inferred that attackers would deliver malicious web content via a browser or an application embedding WebKitGTK. The vulnerability is exploitable remotely through crafted content, making it a high‑alert issue for any system rendering web pages without additional isolation.