This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WebKitGTK and WPE WebKit fix 7 vulnerabilities

WebKitGTK and WPE WebKit version 2.48.1 fix 7 vulnerabilities [1][2]. Apple operating systems and applications and their latest fixed versions: macOS - 15.4 [3], 14.7.5 [4], iOS - 18.4 [5], iPadOS - 18.4 [5], 17.7.6 [6], Safari - 18.4 [7], visionOS - 2.4 [8], tvOS - 18.4 [9].

WebKitGTK and WPE WebKit - DoS (CVE-2025-24264)
CVSS 6.5 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out a DoS attack in applications using WebKitGTK and WPE WebKit [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

WebKitGTK and WPE WebKit - DoS (CVE-2024-54551)
CVSS 6.5 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out a DoS attack in applications using WebKitGTK and WPE WebKit [1][2][10].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

More information:

  • CVE-2024-54551 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 20. 3. 2025.

WebKitGTK and WPE WebKit - DoS (CVE-2025-24209)
CVSS 5.3 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out a DoS attack in applications using WebKitGTK and WPE WebKit [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

More information:

  • CVE-2025-24209 at cve.org, NVD
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org

The vulnerability was publicly disclosed 31. 3. 2025.

WebKitGTK and WPE WebKit - memory corruption (CVE-2025-24213)
CVSS 7.1 (High)

Allows an unauthenticated remote attacker, using social engineering, to corrupt data in memory [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

WebKitGTK and WPE WebKit - XSS (CVE-2025-24208)
CVSS 6.1 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out an XSS attack [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-24208 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 31. 3. 2025.

WebKitGTK and WPE WebKit - DoS (CVE-2025-24216)
CVSS 4.3 (Medium)

Allows an unauthenticated remote attacker, using social engineering, to carry out a DoS attack in applications using WebKitGTK and WPE WebKit [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

More information:

  • CVE-2025-24216 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 31. 3. 2025.

WebKitGTK and WPE WebKit - DoS (CVE-2025-30427)
CVSS 4.3 (Medium)

Allows an unauthenticated remote attacker, due to a use-after-free error and using social engineering, to carry out a DoS attack in applications using WebKitGTK and WPE WebKit [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.1;
  • *:WPE WebKit;<2.48.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 31. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 8. 4. 2025.

CESNET, z.s.p.o. Logo