A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

published 2023-03-02 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-29316

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

Patch / fix

fixed in 1 distros 5

webkitgtk webkitgtk 2.36.8

debian ubuntu red hat suse almalinux

wpewebkit Debian 14, Debian 13, Debian 12 2.38.0-1
webkit2gtk Debian 14, Debian 13, Debian 12 2.38.0-1

debian advisories DEBIAN-CVE-2023-25358

webkit2gtk Ubuntu 20.04 LTS 2.38.6-0ubuntu0.20.04.1
webkit2gtk Ubuntu 22.04 LTS 2.38.6-0ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2023-25358

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

webkit2gtk3 RHEL 8 2.38.5-1.el8
webkit2gtk3-jsc RHEL 8 2.38.5-1.el8
webkit2gtk3 RHEL 9 2.38.5-1.el9
webkit2gtk3-jsc RHEL 9 2.38.5-1.el9
webkitgtk4 RHEL 7 ELS 2.48.3-2.el7_9
webkitgtk4-jsc RHEL 7 ELS 2.48.3-2.el7_9

red hat advisories RHSA-2025:10364 RHSA-2023:2834 RHSA-2023:2256

webkit2gtk3 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +10 more 2.38.6-150200.72.1
webkit2gtk3 SLE Module for Desktop Applications 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk4 SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk3-soup2 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk3 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 2.38.6-2.136.1
webkit2gtk3 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 2.38.6-150000.3.139.1

suse advisories SUSE-SU-2023:2078-1 SUSE-SU-2023:2077-1 SUSE-SU-2023:2065-1 SUSE-SU-2023:2056-1

webkit2gtk3 AlmaLinux 8 2.38.5-1.el8
webkit2gtk3-jsc AlmaLinux 8 2.38.5-1.el8
webkit2gtk3 AlmaLinux 9 2.38.5-1.el9
webkit2gtk3-jsc AlmaLinux 9 2.38.5-1.el9

almalinux advisories ALSA-2023:2834 ALSA-2023:2256

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-25358 updated 2026-11-05 cvss 7.5

webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild()

Red Hat Enterprise Linux 6 webkitgtk Red Hat Enterprise Linux 7 webkitgtk3, libwebkit2gtk
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.38.5-1.el8, webkit2gtk3-jsc 2.38.5-1.el8
fixed: vendor fix RHSA-2023:2834
Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.38.5-1.el9, webkit2gtk3-jsc 2.38.5-1.el9
fixed: vendor fix RHSA-2023:2256
Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4 2.48.3-2.el7_9, webkitgtk4-jsc 2.48.3-2.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-doc 2.48.3-2.el7_9, webkitgtk4-devel 2.48.3-2.el7_9, webkitgtk4-debuginfo 2.48.3-2.el7_9, webkitgtk4-jsc-devel 2.48.3-2.el7_9
fixed: vendor fix RHSA-2025:10364

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-03-07)

Exploit prediction

1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-416 Use After Free

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/
vendor-advisory
security.gentoo.org /glsa/202305-32
vendor-advisory
bugs.webkit.org /show_bug.cgi?id=242683
vendor-advisory
openwall.com /lists/oss-security/2023/04/21/3
mailing-list

Sources

CVE List CVE-2023-25358
NVD CVE-2023-25358

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary