Improper memory handling in Safari’s web content parser can lead to a crash when the browser processes maliciously crafted web pages. The vulnerability is a form of memory corruption that, when triggered by adversarial content, causes the Safari process to terminate unexpectedly.

Apple iOS and iPadOS devices running any version prior to iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, or iPadOS 26.6.1, and macOS Tahoe versions older than 26.6.2 are not yet patched. The memory‑handling fix is included in those updates, so earlier builds likely remain vulnerable, though the data does not explicitly list affected releases.

The CVSS score reported is 4.3; the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is rendering a malicious web page in Safari; when the page is parsed the browser crashes. Because the flaw is client‑side and confined to Safari, an attacker would need to entice a user to open the crafted content to trigger the denial‑of‑service effect.