This vulnerability (CVE-2025-43511) is a use-after-free flaw in the Safari web browser's processing of web content, which can lead to an unexpected process crash. The root cause was improper memory management that allowed a freed object to be accessed. Apple fixed this issue in Safari version 26.2 and related OS versions. Red Hat's advisories confirm the issue affects webkitgtk4 and provide updated packages to remediate it on Red Hat Enterprise Linux 7 Extended Lifecycle Support. The CVSS 3.1 vector indicates the attack vector is network-based, requires no privileges, but requires user interaction, and impacts availability without affecting confidentiality or integrity.

Successful exploitation of this vulnerability may cause Safari or affected webkitgtk4-based browsers to crash unexpectedly, resulting in denial of service. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild at this time.

A fix is available and has been released by Apple in Safari 26.2 and corresponding OS versions (iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2). Users and administrators should update to these versions to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Lifecycle Support, updated webkitgtk4 packages are available as per Red Hat advisories (e.g., RHSA-2026:22136). Applying these updates will mitigate the issue. No additional mitigations are required beyond applying the official patches.