CVE-2026-28903 is a vulnerability in Apple Safari and WebKitGTK+ where processing specially crafted web content can lead to an unexpected process crash due to improper memory handling (CWE-119, CWE-120). The issue affects Safari versions prior to 26.5 and corresponding OS versions including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Red Hat has released security updates for WebKitGTK+ packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this vulnerability. The vulnerability has a CVSS v3.1 base score of 6.5 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and impact limited to availability (denial of service). No known exploits are reported in the wild.

Successful exploitation of this vulnerability may cause the Safari or WebKitGTK+ process to crash unexpectedly, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability arises from improper memory handling when processing maliciously crafted web content.

A fix is available in Safari 26.5 and corresponding OS versions (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should update to these versions to remediate the vulnerability. Red Hat has also released updated WebKitGTK+ packages (e.g., webkitgtk4-2.52.4-1.el7_9) for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these vendor-provided patches will mitigate the issue. Patch status is confirmed by vendor advisories linked from Red Hat. No additional mitigation actions are required beyond applying the official fixes.