CVE-2025-13502: WebKitGTK and WPE WebKit DoS Vulnerability

CVE-2025-13502 Overview

CVE-2025-13502 is a denial-of-service vulnerability affecting WebKitGTK and WPE WebKit. The flaw combines an out-of-bounds read [CWE-125] and an integer underflow in the GLib remote inspector server. An unauthenticated remote attacker can send a crafted payload to the inspector server, triggering a crash of the UIProcess. Successful exploitation does not disclose data or modify integrity, but it terminates the affected browser process and disrupts service availability.

Red Hat has published advisories tracking the issue across multiple supported product streams, and upstream WebKit has acknowledged the defect under WebKit Bug Report #302218.

Critical Impact

A remote, unauthenticated attacker can crash the WebKit UIProcess over the network through the GLib remote inspector server, producing a reliable denial-of-service condition with low attack complexity.

Affected Products

• WebKitGTK (upstream)
• WPE WebKit (upstream)
• Red Hat Enterprise Linux distributions of WebKitGTK and WPE WebKit (see Red Hat advisories RHSA-2025:22789 through RHSA-2025:23743)

Discovery Timeline

• 2025-11-25 - CVE-2025-13502 published to the National Vulnerability Database
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2025-13502

Vulnerability Analysis

The defect resides in the GLib-based remote inspector server used by WebKitGTK and WPE WebKit. The server parses inspector protocol messages received over the network. When a malformed message reaches the parser, two memory safety issues are triggered: an integer underflow during size or offset arithmetic, and a subsequent out-of-bounds read of process memory.

Because the underflowed value is used to compute a buffer index or length, the parser reads past the bounds of the intended allocation. The read corrupts internal state and crashes the WebKit UIProcess, which is the host process for the browser user interface and tab management. The attack is network-reachable, requires no authentication, and requires no user interaction.

Impact is restricted to availability. The CVSS vector indicates no confidentiality or integrity loss, only a high availability impact through process termination.

Root Cause

The root cause is improper validation of length or offset fields before they are used in pointer arithmetic. An integer underflow [CWE-125 in combination with integer-handling weaknesses] produces a value that bypasses bounds checks, allowing the inspector server to dereference memory outside the allocated buffer. The fix is tracked upstream in WebKit Bug Report #302218 and detailed in the Red Hat CVE listing.

Attack Vector

An attacker who can reach the GLib remote inspector TCP listener sends a crafted protocol message. The malformed message triggers the integer underflow, leading to the out-of-bounds read and a UIProcess crash. Exploitation requires the remote inspector server to be enabled and reachable from the attacker, which is not the default configuration for most end-user browser deployments. Embedded devices and development environments that expose the inspector are the primary risk surface.

No verified public proof-of-concept code is available. See Red Hat Bugzilla Report #2416300 for vendor-side technical discussion.

Detection Methods for CVE-2025-13502

Indicators of Compromise

• Unexpected termination or repeated restart of the WebKitGTK or WPE WebKit UIProcess, particularly on hosts where the remote inspector is enabled.
• Inbound TCP connections to the GLib remote inspector listener (commonly bound to a high TCP port) from untrusted networks.
• Crash reports or core dumps from WebKitWebProcess or UIProcess referencing the inspector server parser.

Detection Strategies

• Monitor process lifecycle events for WebKit-based applications and alert when the UIProcess exits abnormally within seconds of an inbound network connection.
• Inspect network telemetry for unsolicited TCP traffic targeting the inspector port and correlate with crash events on the same host.
• Review installed WebKitGTK and WPE WebKit package versions against the fixed versions referenced in the Red Hat advisories.

Monitoring Recommendations

• Enable verbose logging on systems running WebKit-based kiosks, embedded browsers, or set-top box stacks where the inspector may be enabled.
• Track exposure of inspector listeners using network discovery tools and remove listeners that should not be reachable externally.
• Centralize crash telemetry from Linux desktop and embedded fleets so repeated UIProcess crashes are visible across the environment.

How to Mitigate CVE-2025-13502

Immediate Actions Required

• Apply the WebKitGTK and WPE WebKit updates referenced in the Red Hat advisories, including RHSA-2025:22789, RHSA-2025:23110, and RHSA-2025:23743.
• Disable the GLib remote inspector server on production systems where it is not required.
• Restrict network access to inspector listeners using host firewalls and network segmentation.
• Inventory embedded and IoT devices that ship WebKit components and confirm vendor patch availability.

Patch Information

Red Hat has released eleven advisories covering this CVE across supported product streams: RHSA-2025:22789, RHSA-2025:22790, RHSA-2025:23110, RHSA-2025:23433, RHSA-2025:23434, RHSA-2025:23451, RHSA-2025:23452, RHSA-2025:23583, RHSA-2025:23591, RHSA-2025:23742, and RHSA-2025:23743. Apply the advisory matching the affected Red Hat release stream. Upstream fixes are tracked in WebKit Bug Report #302218.

Workarounds

• Bind the remote inspector listener to localhost only, preventing remote network exposure.
• Use firewall rules such as iptables -A INPUT -p tcp --dport <inspector-port> -j DROP to block external access on systems that cannot be patched immediately.
• Disable the inspector entirely by unsetting WEBKIT_INSPECTOR_SERVER in the runtime environment of WebKit-based applications.

# Configuration example: disable the WebKit remote inspector
unset WEBKIT_INSPECTOR_SERVER

# Or block the inspector port at the host firewall (replace 9222 with the configured port)
sudo iptables -A INPUT -p tcp --dport 9222 -j DROP