CVE-2026-78376: Use After Free in Red Hat Red Hat Enterprise Linux 6

This vulnerability (CVE-2026-78376) affects WebKitGTK, the GTK port of the WebKit rendering engine, included in Red Hat Enterprise Linux 6 and later. It is a use-after-free issue caused by improper memory handling when processing malicious web content, specifically in the findFeature function of OpenTypeVerticalData. This can lead to memory corruption and potentially remote code execution. Exploitation requires user interaction by loading malicious content, though in some GNOME components exploitation may occur from the local network without user interaction. The Red Hat advisory recommends avoiding processing untrusted web content and removing certain packages that depend on WebKitGTK4 to mitigate risk. WebKitGTK3 is not required by any package and can be safely removed. The advisory does not explicitly confirm the availability of a patch.

Successful exploitation can cause memory corruption, leading to denial of service (crash) or potentially remote code execution. Confidential data may be read from freed memory. The vulnerability requires user interaction to load malicious web content, except in some GNOME components where local network attackers may exploit it without user interaction. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat advises not to process or load untrusted web content with WebKitGTK. Consider removing packages that depend on WebKitGTK4 (such as evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp) to reduce exposure, noting that removing these may break GNOME functionality. WebKitGTK3 can be removed without consequences. No official patch or fix is explicitly stated in the advisory; therefore, patch status is not yet confirmed—check the vendor advisory for updates.