PT-2025-48026 · Igalia+6 · Wpe Webkit+6

Published 2025-11-19 · Updated 2026-03-30 · CVE-2025-13502

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions WebKitGTK and WPE WebKit (affected versions not specified)

Description A security issue exists in WebKitGTK and WPE WebKit that allows for an out-of-bounds read and integer underflow. Successful exploitation of this issue can lead to a denial-of-service (DoS) condition through a UIProcess crash. The issue is triggered by processing a specially crafted payload sent to the GLib remote inspector server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

ALSA-2025:22789

ALSA-2025:22790

BDU:2026-02744

CVE-2025-13502

DLA-4394-1

DSA-6070-1

OPENSUSE-SU-2026:20065-1

RHSA-2025:22789

RHSA-2025:22790

RHSA-2025:23110

RHSA-2025:23433

RHSA-2025:23434

RHSA-2025:23451

RHSA-2025:23452

RHSA-2025:23583

RHSA-2025:23591

RHSA-2025:23742

RHSA-2025:23743

SUSE-SU-2025:4416-1

SUSE-SU-2025:4423-1

SUSE-SU-2026:0021-1

SUSE-SU-2026:1139-1

SUSE-SU-2026:1150-1

SUSE-SU-2026:20102-1

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Wpe Webkit

Webkitgtk

References · 191

• https://errata.rockylinux.org/RLSA-2025:22790 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-13502 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4394-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23583 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-22789.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:22789 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-22789.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23742 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22790 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22789 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:22790 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:23110 · Vendor Advisory