Processing maliciously crafted web content can trigger a memory handling flaw in the WebKit component, causing an unexpected process crash. The vulnerability stems from improper buffer handling leading to both buffer over-read and buffer overrun (CWE-119 and CWE-120). An attacker does not gain code execution but can exploit this flaw to generate a denial‑of‑service on the affected system by sending crafted web pages that terminate the web rendering process.

Apple devices that use Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. The fix was introduced in Safari 26.3, iOS 18.7.5 and 26.3, iPadOS 18.7.5 and 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. All versions prior to these are susceptible to the crash.

CVSS score 4.3 indicates moderate severity. EPSS < 1% suggests low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly known active exploits. Nonetheless, the attack vector is likely through a user visiting a malicious webpage, leading to a process crash that may impair device stability. Because the flaw does not allow remote code execution, the risk is limited mainly to service disruption.