CVE-2026-83596: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Red Hat Red Hat Enterprise Linux 6

This vulnerability in WebKitGTK involves a classic buffer overflow due to a buffer copy operation without checking the size of input, leading to memory corruption. It can be triggered by processing malicious web content, which may allow an attacker to execute arbitrary code remotely. The flaw affects Red Hat Enterprise Linux 6 where WebKitGTK is used by certain graphical packages. Exploitation requires user interaction except in some GNOME shell scenarios where local network attackers may exploit it without user interaction. The vendor advisory recommends avoiding untrusted content and removing certain packages as mitigation. No official patch or remediation level is currently stated in the advisory.

Successful exploitation can lead to memory corruption with high impact on confidentiality, integrity, and availability, including potential remote code execution. The vulnerability can cause system crashes or denial of service. Exploitation requires user interaction except in specific GNOME shell cases where local network attackers may exploit it without user interaction.

Red Hat advises not to process or load untrusted web content with WebKitGTK. Consider removing packages that require WebKitGTK4 (e.g., evolution-data-server, gnome-shell) to mitigate risk, noting that removal may break GNOME and related functionality. WebKitGTK3 can be removed without consequence. No official patch or fix is currently available; monitor the Red Hat advisory for updates.