The vulnerability is a use‑after‑free defect in Apple’s web rendering engine. Processing maliciously crafted web content may lead to an unexpected Safari crash. The flaw does not allow execution of arbitrary code or compromise of data; the primary consequence is a loss of service for the impacted user with a brief interruption. The weakness is identified by CWE‑416, a classic memory‑management error.

Apple’s Safari, iOS, iPadOS, and macOS Tahoe versions released before Safari 26.5.2, iOS 18.7.10, or iPadOS 18.7.10 are affected. The flaw is remedied by upgrading to Safari 26.5.2 or later, iOS 18.7.10 or later, iPadOS 18.7.10 or later, or macOS Tahoe 26.5.2 or later.

The CVSS score of 6.5 is provided in the advisory, and the EPSS score is 0.00341; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote via delivery of malicious web content to a Safari session. While the exploitability is not quantified, the potential for user interruption means that the risk is higher than a purely informational flaw. Updating to the patched versions removes the risk entirely.