p PatchFirst

CVE-2026-83596

CVE-2026-83596 · Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

CVSS 8.8 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • webkit

    Versions
    • ≥ 1.10.0: Affected (semver)

    No fix published

  • webkitgtk

    Versions
    • ≥ 1.10.0: Affected (semver)

    No fix published

  • red hat enterprise linux 8

    Versions
    • ≥ 0:2.54.0-1.el8_10: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:2.54.0-1.el9_8: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 7

    No fix published

  • webkit2gtk Debian:12

    Versions
    • 2.40.1-1
    • 2.40.2-1
    • 2.40.2-1~deb11u1
    • 2.40.2-1~deb12u1
    • 2.40.3-1
    • 2.40.3-2
    • 2.40.3-2~deb11u1
    • 2.40.3-2~deb11u2
    • 2.40.3-2~deb12u1
    • 2.40.3-2~deb12u2
    • 2.40.4-1
    • 2.40.5-1
    • 2.40.5-1~deb11u1
    • 2.40.5-1~deb12u1
    • 2.41.4-1
    • 2.41.5-1
    • 2.41.6-1
    • 2.41.90-1
    • 2.41.91-1
    • 2.41.91-2
    • 2.41.92-1
    • 2.42.0-1
    • 2.42.0-1~bpo12+1
    • 2.42.1-1
    • 2.42.1-1~bpo12+1
    • 2.42.1-1~deb11u1
    • 2.42.1-1~deb11u2
    • 2.42.1-1~deb12u1
    • 2.42.1-2
    • 2.42.2-1
    • 2.42.2-1~deb11u1
    • 2.42.2-1~deb12u1
    • 2.42.3-1
    • 2.42.3-1~deb11u1
    • 2.42.3-1~deb12u1
    • 2.42.4-1
    • 2.42.4-1~deb11u1
    • 2.42.4-1~deb12u1
    • 2.42.5-1
    • 2.42.5-1~deb11u1
    • 2.42.5-1~deb12u1
    • 2.42.5-2
    • 2.43.1-1
    • 2.43.2-1
    • 2.43.3-1
    • 2.43.4-1
    • 2.43.4-2
    • 2.44.0-1
    • 2.44.0-2
    • 2.44.1-1
    • 2.44.1-1~deb11u1
    • 2.44.1-1~deb12u1
    • 2.44.2-1
    • 2.44.2-1~deb11u1
    • 2.44.2-1~deb12u1
    • 2.44.3-1
    • 2.44.3-1~deb11u1
    • 2.44.3-1~deb12u1
    • 2.44.4-1
    • 2.45.1-1
    • 2.45.1-2
    • 2.45.2-1
    • 2.45.3-1
    • 2.45.4-1
    • 2.45.5-1
    • 2.45.6-1
    • 2.45.91-1
    • 2.45.92-1
    • 2.46.0-1
    • 2.46.0-2
    • 2.46.0-2~deb12u1
    • 2.46.1-1
    • 2.46.1-2
    • 2.46.1-2~bpo12+1
    • 2.46.2-1
    • 2.46.3-1
    • 2.46.3-1~deb11u1
    • 2.46.3-1~deb11u2
    • 2.46.3-1~deb12u1
    • 2.46.4-1
    • 2.46.4-1~deb11u1
    • 2.46.4-1~deb12u1
    • 2.46.5-1
    • 2.46.5-1+hurd.1
    • 2.46.5-1+hurd.2
    • 2.46.5-1~deb11u1
    • 2.46.5-1~deb12u1
    • 2.46.6-1
    • 2.46.6-1~deb11u1
    • 2.46.6-1~deb12u1
    • 2.47.1-1
    • 2.47.2-1
    • 2.47.3-1
    • 2.47.4-1
    • 2.47.90-1
    • 2.48.0-1
    • 2.48.0-1+alpha
    • 2.48.0-1+hurd.1
    • 2.48.0-1+hurd.2
    • 2.48.0-1~deb12u1
    • 2.48.1-1
    • 2.48.1-2
    • 2.48.1-2~deb12u1
    • 2.48.1-3
    • 2.48.2-1
    • 2.48.3-1
    • 2.48.3-1~deb11u1
    • 2.48.3-1~deb12u1
    • 2.48.5-1
    • 2.48.5-1~deb11u1
    • 2.48.5-1~deb12u1
    • 2.48.5-1~deb13u1
    • 2.48.6-1
    • 2.49.90-1
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.1-1~deb11u1
    • 2.50.1-1~deb12u1
    • 2.50.1-1~deb13u1
    • 2.50.2-1
    • 2.50.2-1~deb11u1
    • 2.50.2-1~deb12u1
    • 2.50.2-1~deb13u1
    • 2.50.3-1
    • 2.50.3-1+hurd.1
    • 2.50.3-1~deb11u1
    • 2.50.3-1~deb12u1
    • 2.50.3-1~deb13u1
    • 2.50.4-1
    • 2.50.4-1~deb11u1
    • 2.50.4-1~deb12u1
    • 2.50.4-1~deb13u1
    • 2.50.5-1
    • 2.50.6-1
    • 2.50.6-1~deb11u1
    • 2.50.6-1~deb12u1
    • 2.50.6-1~deb12u2
    • 2.50.6-1~deb13u1
    • 2.51.1-1
    • 2.51.2-1
    • 2.51.3-1
    • 2.51.4-1
    • 2.51.90-1
    • 2.51.91-1
    • 2.51.92-1
    • 2.51.93-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.3-2
    • 2.52.3-2~deb13u1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.5-1~deb13u1
    • 2.52.6-1
    • 2.52.6-1~deb13u1
    • 2.53.1-1
    • 2.53.2-1
    • 2.53.3-1
    • 2.53.4-1
    • 2.53.90-1
    • 2.53.91-1
    • 2.53.92-1
    • 2.54.0-1
    • 2.54.0-1~deb13u1
    • 2.54.0-1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • webkit2gtk Debian:13

    Versions
    • 2.48.3-1
    • 2.48.5-1
    • 2.48.5-1~deb11u1
    • 2.48.5-1~deb12u1
    • 2.48.5-1~deb13u1
    • 2.48.6-1
    • 2.49.90-1
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.1-1~deb11u1
    • 2.50.1-1~deb12u1
    • 2.50.1-1~deb13u1
    • 2.50.2-1
    • 2.50.2-1~deb11u1
    • 2.50.2-1~deb12u1
    • 2.50.2-1~deb13u1
    • 2.50.3-1
    • 2.50.3-1+hurd.1
    • 2.50.3-1~deb11u1
    • 2.50.3-1~deb12u1
    • 2.50.3-1~deb13u1
    • 2.50.4-1
    • 2.50.4-1~deb11u1
    • 2.50.4-1~deb12u1
    • 2.50.4-1~deb13u1
    • 2.50.5-1
    • 2.50.6-1
    • 2.50.6-1~deb11u1
    • 2.50.6-1~deb12u1
    • 2.50.6-1~deb12u2
    • 2.50.6-1~deb13u1
    • 2.51.1-1
    • 2.51.2-1
    • 2.51.3-1
    • 2.51.4-1
    • 2.51.90-1
    • 2.51.91-1
    • 2.51.92-1
    • 2.51.93-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.3-2
    • 2.52.3-2~deb13u1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.5-1~deb13u1
    • 2.52.6-1
    • 2.52.6-1~deb13u1
    • 2.53.1-1
    • 2.53.2-1
    • 2.53.3-1
    • 2.53.4-1
    • 2.53.90-1
    • 2.53.91-1
    • 2.53.92-1
    Affected ranges
    • ECOSYSTEM: < 2.54.0-1~deb13u1

    Update to 2.54.0-1~deb13u1

  • webkit2gtk Debian:14

    Versions
    • 2.48.3-1
    • 2.48.5-1
    • 2.48.5-1~deb11u1
    • 2.48.5-1~deb12u1
    • 2.48.5-1~deb13u1
    • 2.48.6-1
    • 2.49.90-1
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.1-1~deb11u1
    • 2.50.1-1~deb12u1
    • 2.50.1-1~deb13u1
    • 2.50.2-1
    • 2.50.2-1~deb11u1
    • 2.50.2-1~deb12u1
    • 2.50.2-1~deb13u1
    • 2.50.3-1
    • 2.50.3-1+hurd.1
    • 2.50.3-1~deb11u1
    • 2.50.3-1~deb12u1
    • 2.50.3-1~deb13u1
    • 2.50.4-1
    • 2.50.4-1~deb11u1
    • 2.50.4-1~deb12u1
    • 2.50.4-1~deb13u1
    • 2.50.5-1
    • 2.50.6-1
    • 2.50.6-1~deb11u1
    • 2.50.6-1~deb12u1
    • 2.50.6-1~deb12u2
    • 2.50.6-1~deb13u1
    • 2.51.1-1
    • 2.51.2-1
    • 2.51.3-1
    • 2.51.4-1
    • 2.51.90-1
    • 2.51.91-1
    • 2.51.92-1
    • 2.51.93-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.3-2
    • 2.52.3-2~deb13u1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.5-1~deb13u1
    • 2.52.6-1
    • 2.52.6-1~deb13u1
    • 2.53.1-1
    • 2.53.2-1
    • 2.53.3-1
    • 2.53.4-1
    • 2.53.90-1
    • 2.53.91-1
    • 2.53.92-1
    • 2.54.0-1
    • 2.54.0-1~deb13u1
    • 2.54.0-1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpewebkit Debian:12

    Versions
    • 2.38.6-1
    • 2.39.91-1
    • 2.40.0-1
    • 2.40.1-1
    • 2.40.2-1
    • 2.40.2-2
    • 2.40.3-1
    • 2.40.4-1
    • 2.40.5-1
    • 2.42.0-1
    • 2.42.1-1
    • 2.42.2-1
    • 2.42.3-1
    • 2.42.4-1
    • 2.42.5-1
    • 2.42.5-1.1
    • 2.42.5-1.1~exp1
    • 2.42.5-1.2
    • 2.42.5-2~exp
    • 2.44.1-1
    • 2.44.2-1
    • 2.44.2-2
    • 2.44.3-1
    • 2.44.4-1
    • 2.46.1-1
    • 2.46.2-1
    • 2.46.3-1
    • 2.46.4-1
    • 2.46.5-1
    • 2.46.6-1
    • 2.48.0-1
    • 2.48.1-1
    • 2.48.1-2
    • 2.48.2-1
    • 2.48.3-1
    • 2.48.5-1
    • 2.48.6-1
    • 2.48.6-2
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.2-1
    • 2.50.3-1
    • 2.50.4-1
    • 2.50.5-1
    • 2.50.6-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.6-1
    • 2.54.0-1
    • 2.54.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpewebkit Debian:13

    Versions
    • 2.48.3-1
    • 2.48.5-1
    • 2.48.6-1
    • 2.48.6-2
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.2-1
    • 2.50.3-1
    • 2.50.4-1
    • 2.50.5-1
    • 2.50.6-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.6-1
    • 2.54.0-1
    • 2.54.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wpewebkit Debian:14

    Versions
    • 2.48.3-1
    • 2.48.5-1
    • 2.48.6-1
    • 2.48.6-2
    • 2.50.0-1
    • 2.50.0-2
    • 2.50.1-1
    • 2.50.2-1
    • 2.50.3-1
    • 2.50.4-1
    • 2.50.5-1
    • 2.50.6-1
    • 2.52.0-1
    • 2.52.1-1
    • 2.52.2-1
    • 2.52.2-2
    • 2.52.3-1
    • 2.52.4-1
    • 2.52.5-1
    • 2.52.6-1
    Affected ranges
    • ECOSYSTEM: < 2.54.0-1

    Update to 2.54.0-1

  • webkitgtk Ubuntu:16.04:LTS

    Versions
    • 2.4.9-2ubuntu2
    • 2.4.10-0ubuntu1
    • 2.4.11-0ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • webkitgtk Ubuntu:18.04:LTS

    Versions
    • 2.4.11-3
    • 2.4.11-3ubuntu2
    • 2.4.11-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →