A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute co…

published 2023-03-02 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-29320

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

Patch / fix

fixed in 1 distros 4

webkitgtk webkitgtk 2.36.8

debian red hat suse almalinux

wpewebkit Debian 14, Debian 13, Debian 12 2.38.0-1
webkit2gtk Debian 14, Debian 13, Debian 12 2.38.0-1

debian advisories DEBIAN-CVE-2023-25362

webkit2gtk3 RHEL 8 2.38.5-1.el8
webkit2gtk3-jsc RHEL 8 2.38.5-1.el8
webkit2gtk3 RHEL 9 2.38.5-1.el9
webkit2gtk3-jsc RHEL 9 2.38.5-1.el9

red hat advisories RHSA-2023:2834 RHSA-2023:2256

webkit2gtk3 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +10 more 2.38.6-150200.72.1
webkit2gtk3 SLE Module for Desktop Applications 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk4 SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk3-soup2 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 2.38.6-150400.4.39.1
webkit2gtk3 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 2.38.6-2.136.1
webkit2gtk3 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 2.38.6-150000.3.139.1

suse advisories SUSE-SU-2023:2078-1 SUSE-SU-2023:2077-1 SUSE-SU-2023:2065-1 SUSE-SU-2023:2056-1

webkit2gtk3 AlmaLinux 8 2.38.5-1.el8
webkit2gtk3-jsc AlmaLinux 8 2.38.5-1.el8
webkit2gtk3 AlmaLinux 9 2.38.5-1.el9
webkit2gtk3-jsc AlmaLinux 9 2.38.5-1.el9

almalinux advisories ALSA-2023:2834 ALSA-2023:2256

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-25362 updated 2026-11-05 cvss 7.5

webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps()

Red Hat Enterprise Linux 6 webkitgtk Red Hat Enterprise Linux 7 webkitgtk3, webkitgtk4, libwebkit2gtk, webkitgtk4-jsc, webkitgtk4-plugin-process-gtk2
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.38.5-1.el8, webkit2gtk3-jsc 2.38.5-1.el8
fixed: vendor fix RHSA-2023:2834
Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.38.5-1.el9, webkit2gtk3-jsc 2.38.5-1.el9
fixed: vendor fix RHSA-2023:2256

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-03-07)

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-416 Use After Free

References

security.gentoo.org /glsa/202305-32
vendor-advisory
bugs.webkit.org /show_bug.cgi?id=244802
vendor-advisory
openwall.com /lists/oss-security/2023/04/21/3
mailing-list

Sources

CVE List CVE-2023-25362
NVD CVE-2023-25362

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary