The vulnerability is in WebKitGTK's memory handling. Maliciously crafted web content can trigger an out‑of‑bounds write or similar memory corruption that results in the renderer process crashing. Because the crash is not controlled by the attacker, the main impact is denial of service in the affected application or operating system. The flaw is reflected by the CWE labels for incorrect boundary conditions and uncontrolled buffer overflow.

Apple products that incorporate WebKitGTK, including Safari on macOS, iOS and iPadOS, tvOS, and visionOS, are affected until the versions noted below are installed. The fixed versions are Safari 26.1, iOS 18.7.2 and 26.1, iPadOS 18.7.2 and 26.1, macOS Tahoe 26.1, tvOS 26.1, and visionOS 26.1. In addition, several Red Hat Enterprise Linux derivatives that ship the WebKitGTK component—Red Hat Enterprise Linux 8 and 9, RHEL AUS, E4S, EUS, and TUS at the versions listed in the CPE data—may also include the vulnerable code until updated.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score is less than 1 %, implying a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves rendering maliciously crafted web content, either locally or from a remote page that the user visits in a vulnerable browser. Because the flaw only causes a crash and does not provide arbitrary code execution, the overall risk is limited to service interruption for the affected user or system.