CVE-2025-13502

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

HIGH

7.5

CVSS Score

Published: November 25, 2025 at 08:02 AM UTC

Updated: October 18, 2026 at 08:10 PM UTC

3 products affected across 3 vendorsEnterprise LinuxWebKitGTKWebKit

Using Red Hat Enterprise Linux 6 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 6 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Enterprise Linux · Red Hatrpm

90%

All versions7

Vendor states this is fixed in 0:2.50.3-1.el8_10 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_0 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_2 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_4 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_6 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_7 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el7_9 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_2 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_4 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_6 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_8 (unaffected)

Vendor states this is fixed in 6 (unknown)

WebKitGTK · Webkitgtk

90%

0 ≤ v < 2.50.20

Affected range stops below 2.50.2, so it looks safe — our inference, not a vendor statement

WebKit · Webkit

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (14)

VDB Entryx_refsource_REDHAT

Source: [email protected]

https://access.redhat.com/security/cve/CVE-2025-13502

Issue Trackingx_refsource_REDHAT

Source: [email protected]

https://bugzilla.redhat.com/show_bug.cgi?id=2416300