An untrusted web page can trigger a memory corruption condition in Safari by taking advantage of improper locking during content processing. The resulting corruption leads to an application crash, compromising availability for the user’s browsing experience. The weakness is a classic buffer‐overflow or out‑of‑bounds read scenario that can be exploited with crafted web content.

Apple iOS devices running versions prior to 18.7.10 or 26.6.1, Apple iPadOS devices running versions prior to 18.7.10 or 26.6.1, and Apple macOS Tahoe builds prior to 26.6.2 are affected. All devices that run Safari on those operating systems are vulnerable.

The vulnerability has no known code‑execution impact and is limited to a crash that affects availability. Because the EPSS score is not available and it is not listed in the CISA KEV catalog, the likelihood of widespread exploitation appears low. However, malicious actors could craft web pages designed to trigger the crash on vulnerable devices, potentially disrupting services or causing denial of service for users who rely on Safari for critical tasks. The remediation procedure focuses on applying the latest system updates that contain the locking fix.