CVE-2026-20608 is a vulnerability in Apple Safari and WebKitGTK+ where processing specially crafted web content can lead to an unexpected process crash due to improper state management. This denial-of-service condition affects Safari on multiple Apple platforms and WebKitGTK+ on Red Hat Enterprise Linux. The issue has been fixed in Safari 26.3, iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, visionOS 26.3, and WebKitGTK+ 2.52.3. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-120 (Buffer Copy without Checking Size of Input). No evidence of exploitation in the wild has been reported. Red Hat has issued security advisories and patches for affected WebKitGTK+ packages.

Successful exploitation of this vulnerability can cause an unexpected crash of the Safari process or WebKitGTK+ rendering process, resulting in denial of service. There is no indication of confidentiality or integrity impact. The CVSS v3.1 base score of 5.5 reflects a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to availability.

A fix is available and has been released by Apple in Safari 26.3, iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, and visionOS 26.3. Users and administrators should update affected Apple devices to these versions or later. For Red Hat Enterprise Linux systems using WebKitGTK+, apply the security updates that include WebKitGTK+ version 2.52.3 or later as detailed in the Red Hat advisories. No additional mitigation is required beyond applying these official patches.