Improper memory handling in Safari’s web content parser can lead to a crash when the browser processes maliciously crafted web pages. The vulnerability is a form of memory corruption that, when triggered by adversarial content, causes the Safari process to terminate unexpectedly.

Apple iOS and iPadOS devices running any version prior to iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, or iPadOS 26.6.1, and macOS Tahoe versions older than 26.6.2 are not yet patched. The CVE notes that the memory‑handling fix is included in those updates, so earlier builds likely remain vulnerable, though the data does not explicitly list affected releases.

No CVSS score is published and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is rendering a malicious web page in Safari; when the page is parsed the browser crashes. Because the flaw is client‑side and confined to Safari, an attacker would need to entice a user to open the crafted content to trigger the denial‑of‑service effect.