A flaw in the handling of filesystem paths allows a remote attacker to write arbitrary files to the victim device. The vulnerability exists in the Safari web browser and the underlying operating systems of iOS, iPadOS, macOS, and visionOS. The effect is that an attacker may overwrite or create files on the file system, presenting a risk of privilege escalation, data tampering, or compromise of application integrity.

Apple Safari, iOS, iPadOS, macOS, and visionOS devices run the affected code. Versions before Safari 26.3, iOS 18.7.5 or 26.3, iPadOS 18.7.5 or 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3 lack the fix.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page or application that delivers a crafted path to Safari or the related OS component, enabling the attacker to cause the system to resolve and write the file without additional authentication.