This issue involves an out‑of‑bounds memory access and buffer over‑read during the parsing of maliciously crafted web content, as indicated by the CWE‑125 and CWE‑787 identifiers. Processing such content can cause the WebKitGTK‑based browser to crash unexpectedly, resulting in a denial of service to the user or for web‑based applications that rely on the affected rendering engine. The vulnerability does not provide any known mechanism for code execution or data exfiltration, but it can be leveraged to disrupt user experience or impair automated processes that depend on consistent browser operation.

Apple Safari on macOS and visionOS, and the Safari components embedded in iOS and iPadOS installations are impacted. All supported releases prior to version 26.1 are vulnerable; the fix is incorporated in Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1.

The CVSS score of 4.3 reflects a moderate risk with a low likelihood of exploitation, which is further supported by an EPSS score of less than 1 % and the vulnerability not being listed in the CISA KEV catalog. Attackers would need to supply malicious web content that reaches the vulnerable WebKitGTK engine, typically through a web page or embedded content; the effect is limited to a crash of the browser process with no known path to privilege escalation or remote code execution.