Skip to main content

WebKitGTK CVE-2026-83596

| EUVDEUVD-2026-68809 HIGH
Classic Buffer Overflow (CWE-120)
2026-08-31 redhat GHSA-xxgm-wv7m-9vch
Buffer Overflow Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
8.8
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malicious web page
  2. Delivery
    Victim clicks phishing or ad link
  3. Exploit
    WebKitGTK processes crafted content
  4. Execution
    Bounds-unchecked buffer copy overflows memory
  5. Persist
    Attacker-controlled code executes at browser privilege level
  6. Impact
    Host-level access or data exfiltration achieved

Vulnerability Assessment

Weakness
CWE
CWE-120
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must process attacker-controlled web content using a WebKitGTK-based application on an unpatched Red Hat Enterprise Linux 6, 7, 8, or 9 system. No special non-default configuration is required - any default WebKitGTK installation rendering external web content is in scope. Exploitation is constrained by the user interaction requirement (UI:R): the victim must navigate to or load the malicious content, making blind network scanning ineffective; delivery is typically via phishing links, malicious advertisements, or compromised websites. Authentication on the attacker side is not required (PR:N). Exploitation is further limited in practice on systems where WebKitGTK-based browsers are not the primary browser or are not used for external browsing.
Impact

The CVSS 8.8 score is consistent with the vulnerability's mechanics: network-delivered (AV:N), low-complexity exploitation (AC:L), no attacker authentication required (PR:N), with full confidentiality, integrity, and availability impact. The only friction is user interaction (UI:R), meaning exploitation is drive-by rather than blind. No EPSS score was provided in the input data, preventing probabilistic exploitation forecasting. KEV status is absent, so active exploitation is not confirmed. No POC availability data was supplied. The combination of missing EPSS and KEV data means real-world exploitation urgency cannot be precisely ranked; however, the vulnerability class - browser engine memory corruption with full code execution potential - historically attracts rapid weaponization. The broad scope of RHEL 6 through 9 is a compounding factor: RHEL 6 is effectively end-of-life and unlikely to receive timely patches, leaving legacy deployments persistently exposed.
Exploit ScenarioDerived

An attacker crafts a webpage containing malformed content - such as a manipulated media object, oversized HTML structure, or malicious script payload - designed to trigger the bounds-unchecked buffer copy in WebKitGTK's content rendering pipeline. A user on an unpatched RHEL system clicks a phishing link or visits a compromised site, causing the WebKitGTK-based browser to process the content, overflow the buffer, and execute attacker-controlled code at the browser process privilege level. No public proof-of-concept has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 31, 2026

Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.

RemediationAI

The primary fix is to apply the security errata issued by Red Hat for affected RHEL versions using the standard package manager (yum update webkitgtk4 or dnf update webkit2gtk3 depending on RHEL version). Consult https://access.redhat.com/security/cve/CVE-2026-83596 and https://bugzilla.redhat.com/show_bug.cgi?id=2526490 for the specific errata identifiers and confirmed patched package versions, as no exact fixed version number is available in the provided data. For RHEL 6 deployments, which are end-of-life, verify whether Red Hat Extended Life-cycle Support covers this CVE; if not, the compensating control is to disable or remove WebKitGTK-based browser applications, accepting the loss of GNOME Web functionality. In environments where patching is delayed on RHEL 7-9, restricting user access to external web browsing via proxy policy reduces exposure but does not eliminate the attack surface from internal or phishing-delivered content.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

WebKitGTK is the GTK+ port of the WebKit rendering engine, used by GNOME Web (Epiphany), Midori, and other GTK-based Linux browser applications. CWE-120 (Buffer Copy without Checking Size of Input) identifies the root cause: attacker-supplied content is copied into a fixed-size buffer during web content processing without adequate bounds checking, enabling a classic stack or heap overflow. The CPE data confirms the vulnerable packages are those bundled with Red Hat Enterprise Linux 6, 7, 8, and 9. In browser engines, such overflows typically arise in media parsers, HTML/CSS layout engines, or JavaScript JIT compilation paths, where complex, externally supplied data structures are processed at high speed with assumptions about input size.

Know when Red Hat Enterprise Linux 6 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered malicious web content, no authentication needed, user must actively load page; full memory corruption yields high CIA impact with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in WebKitGTK (CVE-2026-83596) enables remote code execution on RHEL 6-9 systems when users view attacker-controlled web content through affected applications. With no vendor patch currently available and a CVSS score of 8.8, this poses an immediate risk to organizations relying on WebKitGTK-based applications across their enterprise infrastructure. Immediate mitigation and monitoring strategies are required until a patch is released.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting user access to untrusted web content within WebKitGTK-based applications, disabling auto-loading of remote content, network segmentation of affected systems, application-level sandboxing where supported, and evaluation of alternative applications or web rendering engines not affected by this vulnerability.

Threat Intelligence Overview

EPSS Score
0.3%
Top 79% exploitable
Prevalence
Medium
GTK browser engine, common on Linux GNOME desktops but not universal
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 6

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-107651 MEDIUM POC
5.5 Oct 08

A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-83596 ADVISORY https://vuldb.com/vuln/397469 REF https://access.redhat.com/errata/RHSA-2026:69098 REF https://access.redhat.com/errata/RHSA-2026:74084 REF https://access.redhat.com/errata/RHSA-2026:89821 REF https://access.redhat.com/errata/RHSA-2026:89822 REF https://access.redhat.com/errata/RHSA-2026:91631 REF https://access.redhat.com/errata/RHSA-2026:92216 REF https://access.redhat.com/errata/RHSA-2026:92339 REF https://access.redhat.com/security/cve/CVE-2026-83596 REF https://bugs.webkit.org/show_bug.cgi?id=322969 REF https://bugzilla.redhat.com/show_bug.cgi?id=2526490

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy