An issue in Apple’s memory handling for Safari and several Apple operating systems can be triggered by maliciously crafted web content, causing an unexpected process crash. The vulnerability is a buffer overflow (CWE‑119), meaning that authorized code can overrun a memory boundary but does not provide an attacker with code‑execution privileges. The primary consequence is a denial‑of‑service outcome whereby the affected application or process terminates unexpectedly.

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS running any version before 26.2 are impacted. The fix is included in Safari 26.2 and the 26.2 releases of iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability that this vulnerability will be actively exploited in the wild. Because the flaw only results in a crash, it is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of malicious web content through a browser or web‑enabled application, so any device connected to the Internet or that received possibly malicious web pages is at risk. Exploitation requires no special privileges beyond accessing the vulnerable application.