webkitgtk: Processing maliciously crafted web content may lead to memory corruption
Published Jul 29, 2025 ·Due Apr 3, 2026
8.8
HIGHCVSS 3.1
EPSS 1.60%
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Affected products
-
- Version 0StatusaffectedConstraints<18.6
- Version
-
- Version 0StatusaffectedConstraints<18.6
- Version
-
- Version 0StatusaffectedConstraints<15.6
- Version
-
- Version 0StatusaffectedConstraints<18.6
- Version
-
- Version 0StatusaffectedConstraints<2.6
- Version
-
- Version 0StatusaffectedConstraints<11.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apple | Safari | n/a |
| ||||||
| Apple | iOS and iPadOS | n/a |
| ||||||
| Apple | macOS | n/a |
| ||||||
| Apple | tvOS | n/a |
| ||||||
| Apple | visionOS | n/a |
| ||||||
| Apple | watchOS | n/a |
|
Configuration 1
Configuration 2
- < 2.50.0
- < 2.50.0
Configuration 3
- 6.0
- 7.0
- 8.0
- 9.0
- 8.2
- 8.4
- 8.6
- 7.0
- 8.4
- 8.6
- 9.4
- 8.6
- 8.8
- 8.6
- 8.8
- 9.0
- 9.2
No data.
Red Hat Enterprise Linux 7 Extended Lifecycle Support
webkitgtk4-0:2.50.0-1.el7_9
Fixed · RHSA-2025:19352
Red Hat Enterprise Linux 8
webkit2gtk3-0:2.50.0-1.el8_10
Fixed · RHSA-2025:17802
Red Hat Enterprise Linux 8.2 Advanced Update Support
webkit2gtk3-0:2.50.0-1.el8_2
Fixed · RHSA-2025:19157
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
webkit2gtk3-0:2.50.0-1.el8_4
Fixed · RHSA-2025:19165
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
webkit2gtk3-0:2.50.0-1.el8_4
Fixed · RHSA-2025:19165
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
webkit2gtk3-0:2.50.0-1.el8_6
Fixed · RHSA-2025:19109
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
webkit2gtk3-0:2.50.0-1.el8_6
Fixed · RHSA-2025:19109
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
webkit2gtk3-0:2.50.0-1.el8_6
Fixed · RHSA-2025:19109
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
webkit2gtk3-0:2.50.0-1.el8_8.1
Fixed · RHSA-2025:17807
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
webkit2gtk3-0:2.50.0-1.el8_8.1
Fixed · RHSA-2025:17807
Red Hat Enterprise Linux 9
webkit2gtk3-0:2.50.1-0.el9_6
Fixed · RHSA-2025:18097
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
webkit2gtk3-0:2.50.0-2.el9_0
Fixed · RHSA-2025:17643
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
webkit2gtk3-0:2.50.0-2.el9_2
Fixed · RHSA-2025:17743
Red Hat Enterprise Linux 9.4 Extended Update Support
webkit2gtk3-0:2.50.0-2.el9_4
Fixed · RHSA-2025:17741
Red Hat Enterprise Linux 6
webkitgtk
Out of support scope
Red Hat Enterprise Linux 7
webkitgtk3
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | webkitgtk4-0:2.50.0-1.el7_9 | Fixed | RHSA-2025:19352 |
| Red Hat Enterprise Linux 8 | webkit2gtk3-0:2.50.0-1.el8_10 | Fixed | RHSA-2025:17802 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | webkit2gtk3-0:2.50.0-1.el8_2 | Fixed | RHSA-2025:19157 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | webkit2gtk3-0:2.50.0-1.el8_4 | Fixed | RHSA-2025:19165 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | webkit2gtk3-0:2.50.0-1.el8_4 | Fixed | RHSA-2025:19165 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | webkit2gtk3-0:2.50.0-1.el8_6 | Fixed | RHSA-2025:19109 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | webkit2gtk3-0:2.50.0-1.el8_6 | Fixed | RHSA-2025:19109 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | webkit2gtk3-0:2.50.0-1.el8_6 | Fixed | RHSA-2025:19109 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | webkit2gtk3-0:2.50.0-1.el8_8.1 | Fixed | RHSA-2025:17807 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | webkit2gtk3-0:2.50.0-1.el8_8.1 | Fixed | RHSA-2025:17807 |
| Red Hat Enterprise Linux 9 | webkit2gtk3-0:2.50.1-0.el9_6 | Fixed | RHSA-2025:18097 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | webkit2gtk3-0:2.50.0-2.el9_0 | Fixed | RHSA-2025:17643 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | webkit2gtk3-0:2.50.0-2.el9_2 | Fixed | RHSA-2025:17743 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | webkit2gtk3-0:2.50.0-2.el9_4 | Fixed | RHSA-2025:17741 |
| Red Hat Enterprise Linux 6 | webkitgtk | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | webkitgtk3 | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity. Additionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.
Red Hat mitigation
Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp. This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction. To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface. Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
Date Added
Mar 20, 2026
Patch Due
Apr 3, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Mar 21, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2025–2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.60% (0.01604) | 74.96th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.43% (0.01428) | 69.41th | v5 (v2026.06.15) |
| Jul 30, 2025 | 0.02% (0.00018) | 3.00th | v4 (v2025.03.14) |
References (29)
- http://seclists.org/fulldisclosure/2025/Aug/0 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/30 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/32 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/36 Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17643 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17741 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17743 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17802 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17807 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:18097 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19109 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19157 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19165 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19352 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-31277 Third Party AdvisoryVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2448780 Third Party AdvisoryIssue Tracking
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ third-party-advisoryTechnical Description
- https://nvd.nist.gov/vuln/detail/CVE-2025-31277
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json Third Party Advisory
- https://support.apple.com/en-us/124147 Release NotesVendor Advisory
- https://support.apple.com/en-us/124149 Release NotesVendor Advisory
- https://support.apple.com/en-us/124152 Release NotesVendor Advisory
- https://support.apple.com/en-us/124153 Release NotesVendor Advisory
- https://support.apple.com/en-us/124154 Release NotesVendor Advisory
- https://support.apple.com/en-us/124155 Release NotesVendor Advisory
- https://webkitgtk.org/security/WSA-2026-0001.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277 government-resourceUS Government Resource
- https://www.cve.org/CVERecord?id=CVE-2025-31277
Change history (0)
No recorded changes yet.