Red Hat Security Advisory: webkitgtk4 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502) * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430) * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421) * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This advisory covers multiple vulnerabilities in WebKitGTK affecting Red Hat Enterprise Linux 8, including CVE-2025-13502 (out-of-bounds read and integer underflow causing denial of service), CVE-2025-43392 (cross-origin image data exfiltration), CVE-2025-13947 (remote user-assisted information disclosure via file drag-and-drop), and numerous others causing process crashes and memory corruption when processing malicious web content. The vulnerabilities span several CWE categories such as CWE-125 (out-of-bounds read), CWE-200 (information disclosure), CWE-119 and CWE-120 (memory corruption), CWE-416 (use after free), and CWE-20 (input validation). Red Hat has released updated webkit2gtk3 packages to address these issues.
Potential Impact
Successful exploitation of these vulnerabilities may lead to denial of service through process crashes or memory corruption, and in some cases, remote user-assisted information disclosure or cross-origin data exfiltration. The CVSS vector for CVE-2025-13502 indicates a high severity denial of service vulnerability exploitable remotely without privileges or user interaction. The overall impact includes potential service disruption and leakage of sensitive image data across origins.
Mitigation Recommendations
Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 8 to address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2025:22789 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patch. Patch status is confirmed as available from Red Hat.
Red Hat Security Advisory: webkitgtk4 security update
Description
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502) * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430) * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421) * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers multiple vulnerabilities in WebKitGTK affecting Red Hat Enterprise Linux 8, including CVE-2025-13502 (out-of-bounds read and integer underflow causing denial of service), CVE-2025-43392 (cross-origin image data exfiltration), CVE-2025-13947 (remote user-assisted information disclosure via file drag-and-drop), and numerous others causing process crashes and memory corruption when processing malicious web content. The vulnerabilities span several CWE categories such as CWE-125 (out-of-bounds read), CWE-200 (information disclosure), CWE-119 and CWE-120 (memory corruption), CWE-416 (use after free), and CWE-20 (input validation). Red Hat has released updated webkit2gtk3 packages to address these issues.
Potential Impact
Successful exploitation of these vulnerabilities may lead to denial of service through process crashes or memory corruption, and in some cases, remote user-assisted information disclosure or cross-origin data exfiltration. The CVSS vector for CVE-2025-13502 indicates a high severity denial of service vulnerability exploitable remotely without privileges or user interaction. The overall impact includes potential service disruption and leakage of sensitive image data across origins.
Mitigation Recommendations
Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 8 to address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2025:22789 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patch. Patch status is confirmed as available from Red Hat.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:23583
- Cve Count
- 18
- Additional Cves
- ["CVE-2025-13947","CVE-2025-43392","CVE-2025-43421","CVE-2025-43425","CVE-2025-43427","CVE-2025-43429","CVE-2025-43430","CVE-2025-43431","CVE-2025-43432","CVE-2025-43433","CVE-2025-43434","CVE-2025-43438","CVE-2025-43440","CVE-2025-43441","CVE-2025-43443","CVE-2025-43458","CVE-2025-66287"]
- Cvss Version
- 3.1
Threat ID: 6a3da1d84853345fc1827da5
Added to database: 06/25/2026, 21:47:04 UTC
Last enriched: 07/15/2026, 15:05:02 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.