This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WebKitGTK and WPE WebKit fix 11 vulnerabilities

WebKitGTK and WPE WebKit version 2.48.5 fix 11 vulnerabilities. Selected ones are described below; the remaining ones can be found at [1][2]. Apple products and their latest fixed versions: macOS - Sequoia 15.6 [3], Sonoma 14.7.7 [4], Ventura 13.7.7 [5] iOS - 18.6 [6] iPadOS - 18.6 [6], 17.7.9 [7] watchOS - 11.6 [8] tvOS - 18.6 [9] visionOS - 2.6 [10] Safari - 18.6 [11]

WebKitGTK and WPE WebKit - memory corruption (CVE-2025-31273, CVE-2025-31278)
CVSS 7.1 (High)

An unauthenticated remote attacker, by means of social engineering and specially crafted web content, is able to corrupt data in memory [1][2].

The vulnerability is present in products:

  • WebKitGTK; <2.48.5;
  • WPE WebKit; <2.48.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

The vulnerability was publicly disclosed 29. 7. 2025.

WebKitGTK and WPE WebKit - sensitive information disclosure (CVE-2025-43227)
CVSS 6.5 (Medium)

An unauthenticated remote attacker, by means of social engineering and specially crafted web content, is able to obtain sensitive user information [1][2][12].

The vulnerability is present in products:

  • WebKitGTK; <2.48.5;
  • WPE WebKit; <2.48.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 29. 7. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 6. 8. 2025.

CESNET, z.s.p.o. Logo