RHSA-2025:23971HighCVSS 8.8

Red Hat Security Advisory: webkit2gtk3 security update

Published
December 24, 2025
Last Modified
November 3, 2026

🔗 CVE IDs covered (7)

CVE-2025-43501 →CVE-2025-43529 →CVE-2025-43531 →CVE-2025-43535 →CVE-2025-43536 →CVE-2025-43541 →CVE-2025-14174 →

📋 Description

CVE-2025-14174 — Google Chrome: chromium: webkitgtk: Out of bounds memory access via crafted HTML page CVE-2025-43501 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-43529 — webkitgtk: webkitgtk: Use-after-free due to improper memory management CVE-2025-43531 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-43535 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-43536 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-43541 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-0:2.50.4-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debuginfo-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debuginfo-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debuginfo-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debuginfo-0:2.50.4-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debuginfo-0:2.50.4-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debugsource-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debugsource-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debugsource-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debugsource-0:2.50.4-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-debugsource-0:2.50.4-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-0:2.50.4-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-0:2.50.4-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-debuginfo-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-debuginfo-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-debuginfo-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-debuginfo-0:2.50.4-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-devel-debuginfo-0:2.50.4-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-jsc-0:2.50.4-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-jsc-0:2.50.4-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • webkit2gtk3-jsc-0:2.50.4-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, avoid processing untrusted web content. Additionally, disabling the JavaScript JIT compiler can reduce the attack surface. For applications using WebKitGTK, set the environment variable `JavaScriptCoreUseJIT=0` before launching the application. This may impact performance for JavaScript-heavy web content.

🔗 References (9)