This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WebKitGTK and WPE WebKit fix 7 vulnerabilities

WebKitGTK and WPE WebKit versions 2.50.4 fix 7 vulnerabilities. The most severe selected ones are described below; the remaining ones can be found at [1][2]. Apple products and their fixed versions: iOS - 26.2 [3], 18.7.3 [4] iPadOS - 26.2 [3], 18.7.3 [4] macOS - Tahoe 26.2 [5], Sonoma 14.8.3 [6], Sequoia 15.7.3 [7] tvOS - 26.2 [8] watchOS - 26.2 [9] visionOS - 26.2 [10] Safari - 26.2 [11]

WebKitGTK, WPE WebKit - RCE (CVE-2025-43529)
CVSS 8.8 (High)

An unauthenticated remote attacker can execute arbitrary code by means of social engineering [12]. The vulnerability is already being actively exploited in sophisticated attacks against specific targets running iOS versions earlier than 26 [12][13].

The vulnerability is present in products:

  • WebKitGTK; <2.50.4;
  • WebKitGTK; <2.50.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 12. 2025.

WebKitGTK, WPE WebKit - memory corruption (CVE-2025-14174)
CVSS 7.1 (High)

An unauthenticated remote attacker can corrupt data in memory by means of social engineering [1][2]. The vulnerability (originally discovered in ANGLE of Google Chrome on macOS systems [14]) is already being actively exploited [15].

The vulnerability is present in products:

  • WebKitGTK; <2.50.4;
  • WebKitGTK; <2.50.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-14174 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 17. 12. 2024.

WebKitGTK, WPE WebKit - process crash (CVE-2025-43501)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can cause a process crash without authorization [16].

The vulnerability is present in products:

  • WebKitGTK; <2.50.4;
  • WebKitGTK; <2.50.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 17. 12. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 2. 1. 2026.

CESNET, z.s.p.o. Logo