A use‑after‑free flaw in WebKit’s memory management can be triggered by specially crafted web content, causing Safari to crash unexpectedly. The flaw arises after the library attempts to access freed memory, leading to a program termination that may allow local users to disrupt service but does not grant code execution or data exfiltration. The vulnerability is classified as CWE‑416 and rated with a CVSS score of 6.5, indicating a moderate severity.

Apple Safari on macOS Sequoia 15.6, iOS 18.6, iPadOS 18.6 and 17.7.9, tvOS 18.6, visionOS 2.6, and watchOS 11.6, along with associated WebKit components on all these platforms. The issue is mitigated with the official updates released by Apple for these operating systems and browsers.

The risk is that an attacker can cause a denial of service by driving a target user to load maliciously crafted web pages. The EPSS score is less than 1%, suggesting exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote via the web; an attacker merely needs to entice a user to visit a malicious site, which is a conventional web‑based attack rather than a privileged or privileged code execution scenario.