An out‑of‑bounds access flaw in Apple’s Safari rendering engine was corrected with bounds checking. When a malicious web page is rendered, the flaw can cause unexpected memory corruption and crash the browser, denying service to the user. The description does not indicate that the crash could be leveraged for code execution or data exfiltration, so the primary consequence is destabilization rather than privilege escalation.

Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, and Apple watchOS are affected. The vulnerability is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6.

The CVSS score of 9.8 signals a high severity problem, yet the EPSS score of less than 1% indicates that the likelihood of public exploitation is very low. It is not listed in the CISA KEV catalog. Attackers would need to drive the victim’s Safari to process a specifically crafted web page; because Safari is a common browser, the vector is remote via normal web traffic. No further conditions are noted in the entry, so the flaw may be exploitable from a standard network connection without additional access.