The vulnerability is an improper memory handling flaw in Safari, iOS, iPadOS, and macOS. When maliciously crafted web content is processed, the application can crash unexpectedly. The crash leads to a denial‑of‑service condition because the affected process stops functioning, potentially disrupting user workflows during browsing sessions.

Apple Safari, iOS, iPadOS, and macOS sectors are impacted. The flaw has been fixed as of Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Earlier releases of these operating systems are vulnerable.

The impact is limited to a process crash, which can be leveraged by an attacker to cause a denial of service on the client device. The exploit requires delivering malicious web content, most likely via a remote attacker controlling a website or compromised network element. EPSS data is not available, so exploitation probability cannot be quantitatively assessed, and the issue is not included in the CISA KEV catalog.