The vulnerability is a use‑after‑free bug in Apple’s memory management that allows maliciously crafted web content to cause an unexpected process crash. The flaw is limited to memory handling and does not provide code execution or data disclosure, but results in instability and potential denial of service.

Apple iOS and iPadOS devices running versions older than iOS 18.7.10 and 26.6.1, iPadOS older than iOS 18.7.10 and 26.6.1, and macOS Tahoe versions older than 26.6.2 are affected. Updated releases are iOS 18.7.10/26.6.1, iPadOS 18.7.10/26.6.1, and macOS Tahoe 26.6.2.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting limited known exploitation. It is inferred that an attacker would need to lure a user to a malicious website that serves specially crafted content, which could trigger the crash. Although the flaw does not provide direct remote code execution, it can be used to disrupt device operation and create a denial‑of‑service condition, especially if the crash occurs in a critical subsystem.