CVE-2025-13502CWE-125

CVE-2025-13502

High · published November 25, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

⚡ A crafty payload can crash the UI process—no superhero cape required! This vulnerability in WebKitGTK and WPE WebKit is more dangerous than it seems. 🔥 Think of it like a concert where one overly excited fan trips the power, shutting down the whole show—everyone's left in the dark! This out-of-bounds read and integer underflow disrupts the GLib remote inspector server, leaving users unable to access their interfaces. An attacker can send a specially crafted payload that causes a denial of service by crashing the UI process. This means users will face unexpected outages, interrupting their activities and potentially leading to financial losses or reputational damage.

Put simply

Think of it like a concert where one overly excited fan trips the power, shutting down the whole show—everyone's left in the dark! This out-of-bounds read and integer underflow disrupts the GLib remote inspector server, leaving users unable to access their interfaces. This vulnerability in WebKitGTK and WPE WebKit arises from an out-of-bounds read and integer underflow, allowing an attacker to exploit the GLib remote inspector server, resulting in a crash of the UI process.

What to do

An attacker can send a specially crafted payload that causes a denial of service by crashing the UI process. This means users will face unexpected outages, interrupting their activities and potentially leading to financial losses or reputational damage. Update to the latest version of WebKitGTK and WPE WebKit as soon as possible. Monitor your systems for any unusual activity and consider implementing additional layers of security to help mitigate potential risks. You've got this! With these steps, you'll have your systems back to superhero status in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00578 · 46.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-11-25T13:15Z
References (14)
EPSS history
Timeline
  • 25 NOV 08:02Z
    Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos
    cvelistv5