CVE-2026-20636 is a vulnerability in Apple Safari caused by improper memory handling when processing maliciously crafted web content, which may lead to an unexpected process crash. This vulnerability affects Safari versions prior to 26.3 and related OS versions (iOS, iPadOS, macOS Tahoe, visionOS). The issue has been addressed by Apple with improved memory handling in Safari 26.3 and corresponding OS updates. Red Hat has also issued security advisories and updates for WebKitGTK+ packages that include fixes for this vulnerability among others. The CVSS v3.1 base score is 6.5, indicating a medium severity impact primarily affecting availability (denial of service via crash). There are no known active exploits reported. The vulnerability is classified under CWE-119 and CWE-120, which relate to memory safety errors.

Successful exploitation of this vulnerability may cause Safari to crash unexpectedly when processing maliciously crafted web content, resulting in denial of service. There is no indication of confidentiality or integrity impact. No known exploits are currently reported in the wild.

A fix is available and has been released by Apple in Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3. Users and administrators should update affected Safari and operating system versions to these or later releases to remediate the vulnerability. Red Hat has also provided updated WebKitGTK+ packages for their supported platforms that address this issue. Applying these official patches is the recommended mitigation.