Processing maliciously crafted web content may lead to memory corruption. The flaw arises from insufficient bounds checking in WebKitGTK’s memory handling routine, exposing buffer overread, overflow, and arbitrary memory write weaknesses (CWE‑119, CWE‑120, CWE‑787). An attacker who can supply specially crafted web pages or scripts to the affected browser or embedded webview may trigger this corruption, potentially allowing code execution, data manipulation, or denial of service.

In Apple products, all versions of Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS running prior to the security fixes delivered in Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1 are impacted. In Red Hat Enterprise Linux, all active RHEL 8.x and RHEL 9.x releases—including RHEL 8.2, 8.4, 8.6, 8.8, 9.0, 9.2, 9.4, 9.6, and the various extended‑life and future‑support streams—contain the vulnerable WebKitGTK component as identified by the listed CPEs.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of real‑world exploitation is low. The flaw is not listed in CISA KEV, implying no published exploit. The most probable attack vector involves an attacker delivering malicious web content through a compromised website, phishing email, or embedded webview in an application. Because the bug causes memory corruption, successful exploitation could lead to arbitrary code execution, compromising user data and system integrity.