An out‑of‑bounds write flaw in Apple’s Safari, iOS, iPadOS, and macOS Tahoe can be triggered by maliciously crafted web content, corrupting memory and causing Safari to crash. The vulnerability forces the browser to terminate, leading to a denial‑of‑service for the user. Based on the description, it is inferred that the flaw does not provide remote code execution or data exfiltration, as the crash is confined to memory corruption without an observable escape to system-level control.

Apple Safari, iOS, iPadOS, and macOS Tahoe running any version prior to 26.5.2 are vulnerable; the issue was resolved in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The CVSS score of 6.5 reflects moderate severity, and no EPSS data is available. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widescale exploitation. The likely attack vector involves delivering specially crafted web content to a target’s browser, typically by directing the user to a malicious or compromised website that injects the overflow payload. Successful exploitation would crash Safari but would not compromise system integrity or confidentiality.