A memory corruption flaw arises when a victim processes specially crafted web content, allowing an attacker to corrupt memory and potentially execute arbitrary code. The vulnerability stems from inadequate memory handling during web content rendering, which can overwrite critical data structures. This type of flaw can compromise the confidentiality, integrity, and availability of the affected system. The damage range extends from local privilege escalation to full system compromise, depending on the execution context of the malicious content.

Apple iOS, iPadOS, and macOS are affected. The flaw is fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Users running any earlier releases of these operating systems are at risk.

No EPSS or KEV data are available, and no CVSS score is reported for this issue. The vulnerability requires a maliciously crafted web page or document to be processed by the target, indicating that the attack vector is likely network or user‑initiated via the web. Because the flaw can lead to arbitrary code execution, it poses a high severity risk. Although the likelihood of exploitation is not quantified, the lack of mitigations in affected versions means that an attacker could exploit this flaw if a user visits or opens a malicious web resource.