Out-of-bounds read and integer underflow vulnerability in the GLib remote inspector server of WebKitGTK and WPE WebKit. The WTF::SocketConnection::readMessage() function uses strlen() over framed, peer-controlled data without constraining the scan to the declared bodySize. If a crafted payload omits a NUL terminator within that body, the function reads beyond the frame boundary, causing an out-of-bounds read and UIProcess crash (DoS). In addition, the computed messageNameLength is not validated against bodySize before calculating parametersSize = bodySize - messageNameLength, risking integer underflow. A remote, unauthenticated client can trigger this condition whenever the remote inspector server is enabled and reachable, but the feature is primarily intended for debugging and is disabled by default, which limits practical exposure.
This comment was flagged as spam, view the edit history to see the original text if required.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:22789 https://access.redhat.com/errata/RHSA-2025:22789
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:22790 https://access.redhat.com/errata/RHSA-2025:22790
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2025:23110 https://access.redhat.com/errata/RHSA-2025:23110
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:23433 https://access.redhat.com/errata/RHSA-2025:23433
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2025:23434 https://access.redhat.com/errata/RHSA-2025:23434
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:23451 https://access.redhat.com/errata/RHSA-2025:23451
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:23452 https://access.redhat.com/errata/RHSA-2025:23452
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:23591 https://access.redhat.com/errata/RHSA-2025:23591
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:23583 https://access.redhat.com/errata/RHSA-2025:23583
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:23743 https://access.redhat.com/errata/RHSA-2025:23743
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:23742 https://access.redhat.com/errata/RHSA-2025:23742