VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVPublished CVSS 7.5 highEPSS 0.6% probability of exploitation in 30 daysFound by AI: AISLE
Red Hat

CVE-2025-13502: Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?
0.6%

EPSS score, percentile 49.6 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
7.5 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (11)

Which versions are affected?

Affected

  • before 2.50.2

Unaffected 0:2.50.3-2.el7_9; 0:2.50.3-1.el8_10; 0:2.50.3-2.el8_2; 0:2.50.3-2.el8_4; 0:2.50.3-2.el8_4; 0:2.50.3-2.el8_6; and 9 more

Versions by product

Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

What to do

Advisories and patches

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

As listed in the CVE record.

The WebKitGTK Team webkitgtk
StatusVersions
Affectedbefore 2.50.2

Versions not listed are: unaffected.

Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
StatusVersions
Unaffected0:2.50.3-2.el7_9

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8
StatusVersions
Unaffected0:2.50.3-1.el8_10

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
StatusVersions
Unaffected0:2.50.3-2.el8_2

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
StatusVersions
Unaffected0:2.50.3-2.el8_4

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
StatusVersions
Unaffected0:2.50.3-2.el8_4

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
StatusVersions
Unaffected0:2.50.3-2.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
StatusVersions
Unaffected0:2.50.3-2.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.50.3-2.el8_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
StatusVersions
Unaffected0:2.50.3-2.el8_8

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.50.3-2.el8_8

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9
StatusVersions
Unaffected0:2.50.3-1.el9_7

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.50.3-1.el9_0

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
StatusVersions
Unaffected0:2.50.3-1.el9_2

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
StatusVersions
Unaffected0:2.50.3-1.el9_4

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
StatusVersions
Unaffected0:2.50.3-1.el9_6

Versions not listed are: affected.

Red Hat Red Hat Enterprise Linux 6
StatusVersions

Versions not listed are: unknown.

Red Hat Red Hat Enterprise Linux 7
StatusVersions

Versions not listed are: affected.

Versions the record lists as unaffected: 0:2.50.3-2.el7_9, 0:2.50.3-1.el8_10, 0:2.50.3-2.el8_2, 0:2.50.3-2.el8_4, 0:2.50.3-2.el8_6, 0:2.50.3-2.el8_8, 0:2.50.3-1.el9_7, 0:2.50.3-1.el9_0.

Source: CVE List, as of . About the data.

About this vulnerability

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

Summary: CVE record, as of .

  • CISA has not added CVE-2025-13502 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
  • The CVE record was published on 25 Nov 2025.
  • The CVE record carries a CVSS v3.1 base score of 7.5 (High), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.6% (percentile 49.6), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
  • CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
  • The credits in the CVE record name AISLE as finder.

Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.

Description

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

Source: CVE List, as of . About the data.

Weakness

CWE-125

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

3

2 more in the CVE record.

Known exploited Red Hat vulnerabilities

  • CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability (added )
  • CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (added )
  • CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (added )
  • CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability (added )
  • CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (added )