CVE-2026-20664 is a vulnerability in Apple Safari caused by improper memory handling when processing maliciously crafted web content, which may lead to an unexpected process crash. This issue affects Safari versions before 26.4 and related OS versions (iOS, iPadOS, macOS Tahoe, visionOS) prior to 26.4. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-120 (Classic Buffer Overflow). The vendor fixed the issue by improving memory handling in Safari 26.4 and corresponding OS updates. Red Hat's advisories for WebKitGTK+ also address this vulnerability in their packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The CVSS v3.1 base score is 4.3 (medium severity), indicating a network attack vector with low complexity and requiring user interaction, causing only availability impact (process crash) without confidentiality or integrity loss. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability may cause Safari to crash unexpectedly when processing maliciously crafted web content, resulting in a denial of service for the user. There is no indication of confidentiality or integrity impact. No known exploits are currently active in the wild.

This vulnerability has been fixed in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 through improved memory handling. Users and administrators should update affected Safari and operating system versions to these fixed releases or later. Red Hat has also released security updates for WebKitGTK+ packages addressing this issue; applying these updates on Red Hat Enterprise Linux 7 Extended Lifecycle Support systems will mitigate the vulnerability. Patch status is confirmed as fixed in these versions.