This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WebKitGTK and WPE WebKit fix 13 vulnerabilities

WebKitGTK and WPE WebKit versions 2.50.2 fix 13 vulnerabilities. The most severe ones are described below; the remaining ones can be found at [1][2]. Apple products and their fixed versions: iOS - 26.1 [3], 18.7.2 [4] iPadOS - 26.1 [3], 18.7.2 [4] macOS - Tahoe 26.1 [5], Sonoma 14.8.2 [6], Sequoia 15.7.2 [7] tvOS - 26.1 [8] watchOS - 26.1 [9] visionOS - 26.1 [10] Safari - 26.1 [11]

WebKitGTK, WPE WebKit - memory corruption (CVE-2025-43419)
CVSS 7.1 (High)

An unauthenticated remote attacker can corrupt data in memory by means of social engineering [12].

The vulnerability is present in products:

  • WebKitGTK; <2.50.0;
  • WPE WebKit; <2.50.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-43419 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 3. 11. 2025.

WebKitGTK, WPE WebKit - data exfiltration (CVE-2025-43480)
CVSS 6.5 (Medium)

An unauthenticated remote attacker can exfiltrate the victim's data by means of social engineering [13].

The vulnerability is present in products:

  • WebKitGTK; <2.46.0;
  • WPE WebKit; <2.46.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 3. 11. 2025.

WebKitGTK, WPE WebKit - process crash (CVE-2025-43432)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can cause a process crash without authorization [14].

The vulnerability is present in products:

  • WebKitGTK; <2.50.2;
  • WPE WebKit; <2.50.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 3. 11. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 28. 11. 2025.

CESNET, z.s.p.o. Logo