CVE-2025-13502
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Nov 25, 2025
CISA due date
—
The record
A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 16.0 | webkit2gtk3 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk3-soup2 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk4 | 0 | 2.50.4-160000.1.1 |
Related vulnerabilities
- CVE-2025-43536 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3-soup2
- CVE-2025-43531 A race condition was addressed with improved state handling. Also affects webkit2gtk3-soup2
- CVE-2025-43529 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3-soup2
- CVE-2025-66287 A flaw was found in WebKitGTK. Also affects webkit2gtk3-soup2
- CVE-2025-13947 A flaw was found in WebKitGTK. Also affects webkit2gtk3-soup2
- CVE-2023-43000 A use-after-free issue was addressed with improved memory management. Also affects webkit2gtk3-soup2
- CVE-2025-43480 The issue was addressed with improved checks. Also affects webkit2gtk3-soup2
- CVE-2025-43458 This issue was addressed through improved state management. Also affects webkit2gtk3-soup2