This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WebKitGTK and WPE WebKit fix 6 vulnerabilities

WebKitGTK and WPE WebKit version 2.48.2 fix 6 vulnerabilities. The most severe of them are described below; the rest can be found at [1][2]. Apple products and their latest fixed versions: macOS - 13.7.6 [3], 14.7.6 [4], 15.5 [5] iOS - 18.5 [6] iPadOS - 17.7.7 [7], 18.5 [6] watchOS - 11.5 [8] tvOS - 18.5 [9] visionOS - 2.5 [10] Safari - 18.5 [11]

WebKitGTK and WPE WebKit - memory corruption (CVE-2025-31204)
CVSS 7.1 (High)

An unauthenticated remote attacker can, using social engineering, corrupt memory when processing malicious web content [1][2]. We have previously reported on the fix for this vulnerability in Apple operating systems [12].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.2;
  • *:WPE WebKit;<2.48.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-31204 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 12. 5. 2025.

WebKitGTK and WPE WebKit - memory corruption (CVE-2025-24223)
CVSS 7.1 (High)

An unauthenticated remote attacker can, using social engineering, corrupt memory when processing malicious web content [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.2;
  • *:WPE WebKit;<2.48.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-24223 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 12. 5. 2025.

WebKitGTK and WPE WebKit - data exfiltration (CVE-2025-31205)
CVSS 6.5 (Medium)

An unauthenticated remote attacker can, using social engineering, exfiltrate data from another domain (cross-origin) without authorization [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.2;
  • *:WPE WebKit;<2.48.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 12. 5. 2025.

WebKitGTK and WPE WebKit - DoS (CVE-2025-31215)
CVSS 6.5 (Medium)

An unauthenticated remote attacker can perform a DoS attack using social engineering [1][2].

The vulnerability is present in products:

  • *:WebKitGTK;<2.48.2;
  • *:WPE WebKit;<2.48.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 12. 5. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 19. 5. 2025.

CESNET, z.s.p.o. Logo