An out‑of‑bounds access flaw was addressed by adding bounds checking to Safari’s rendering engine. When Safari processes malicious web content, it can crash unexpectedly. The crash leads to a denial of user service for the affected session, but it does not provide code execution or privileged access.

Apple iOS and iPadOS versions 18.7.10 and 26.6.1, and macOS Tahoe version 26.6.2 are impacted. These versions require an update to the patched release to mitigate the issue.

The CVSS score is not provided and EPSS is unavailable, indicating no user‑visible exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft malicious web pages that trick a user into visiting them via Safari. Because the flaw only causes a crash and no information disclosure or privilege escalation, the overall exploitation risk is modest. Regular users without the patched software remain at risk until they run a security update.