CVE-2025-24201

A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox.

This vulnerability is only a risk for servers which utilize a GUI for system administration. This vulnerability can only be exploited when specific packages are used with a graphical interface to process untrusted web content, via GNOME for example.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Systems which do not rely on a GUI for system administration (commonly referred to as "headless") should confirm that GNOME shell and WebKitGTK are not present on the system.

WebKitGTK3 is no longer used and can therefore be uninstalled without consequence.

WebKitGTK4 is used in Red Hat Enterprise Linux 7 by the following packages: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

To mitigate this vulnerability, consider removing certain GNOME packages. Note that uninstalling these packages will break functionality in GNOME, however the server can still be used via the terminal interface.