A flaw in WebKitGTK’s memory handling allows maliciously crafted web content to cause an unexpected Safari crash. The vulnerability does not grant code execution or privilege escalation; it results in a denial of service by terminating the browser instance or the entire web rendering component. The weakness maps to CWE‑119, which involves improper handling of memory buffers.

The issue affects Apple’s Safari browser on all supported Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Specifically, Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6 incorporate the fix; versions prior to these are vulnerable.

The CVSS score of 6.5 places the vulnerability in the moderate severity range. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there are no publicly confirmed exploits. Based on the description, it is inferred that the attacker would need to deliver specially crafted web content—typically via a webpage or email attachment—to trigger the crash, making the vulnerability primarily a local denial of service with no remote code execution capability.