High · published July 30, 2025
CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 76.4th percentile for exploit probability.
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
| Product | Versions | Fixed in |
|---|---|---|
| apple/safari | < 18.6 | 18.6 |
| apple/ipados | < 18.6 | 18.6 |
| apple/iphone_os | < 18.6 | 18.6 |
| apple/macos | ≥ 15.0, < 15.6 | 15.6 |
| apple/tvos | < 18.6 | 18.6 |
| apple/visionos | < 2.6 | 2.6 |
| apple/watchos | < 11.6 | 11.6 |
| webkitgtk/webkitgtk | < 2.50.0 | 2.50.0 |
| wpewebkit/wpe_webkit | < 2.50.0 | 2.50.0 |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_aus | all versions | — |
| redhat/enterprise_linux_aus | all versions | — |
| redhat/enterprise_linux_aus | all versions | — |
| redhat/enterprise_linux_els | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_tus | all versions | — |
| redhat/enterprise_linux_tus | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |