CVE-2025-13502
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A flaw in WebKitGTK and WPE WebKit allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
Risk Assessment
An attacker can remotely crash the UI process, causing denial of service for applications using WebKitGTK or WPE WebKit.
Recommendation
Immediately update WebKitGTK and WPE WebKit to the latest patched version. Restrict access to the GLib remote inspector server to trusted networks only.
Other vulnerabilities in WebKitGTK
See all- CVE-2015-2330High
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- CVE-2026-78376High
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
- CVE-2025-66287High
A flaw was found in WebKitGTK due to improper memory handling. Processing malicious web content can cause an unexpected process crash.
- CVE-2025-13947High
A vulnerability was found in WebKitGTK that allows remote, user-assisted information disclosure. The flaw is due to missing verification of the source of file drag-and-drop operations, enabling an attacker to read any file the user is permitted to access.
Original NVD description (English source)
A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.