An out-of-bounds read in the WebKitGTK engine can be triggered by maliciously crafted web content. The flaw allows an attacker to read memory contents beyond the intended buffer and may expose internal state information of the application. The weakness is identified as CWE-125 and can lead to the leak of sensitive data within the browser or webview context, but does not provide execution or denial of service capabilities.

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The vulnerability exists in Safari versions prior to 18.6, iOS and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6, which are the versions that contain the fixed input validation logic.

The CVSS score of 4.0 denotes a low to moderate risk, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog. The likely attack vector involves delivering malicious web content via a web page or embedded web view that the user visits, which is an inferred scenario because the CVE statement specifies that processing maliciously crafted content may disclose internal states.