---
id: CVE-2019-8720
title: A vulnerability was found in WebKit
summary: >-
  A vulnerability was found in WebKit. The flaw is triggered when processing
  maliciously crafted web content that may lead to arbitrary code execution.
  Improved memory handling addresses the multiple memory corruption issues.
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
vendor: webkitgtk
product: webkitgtk
affected:
  - webkitgtk < 2.26.0
  - wpe_webkit < 2.26.0
  - codeready_linux_builder = 8.0
  - codeready_linux_builder_eus = 8.4
  - codeready_linux_builder_eus = 8.6
  - codeready_linux_builder_for_arm64_eus = 8.0
  - codeready_linux_builder_for_arm64_eus = 8.4
  - codeready_linux_builder_for_arm64_eus = 8.6
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.0
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.4
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.6
  - codeready_linux_builder_for_power_little_endian_eus = 8.0
  - codeready_linux_builder_for_power_little_endian_eus = 8.4
  - codeready_linux_builder_for_power_little_endian_eus = 8.6
  - enterprise_linux = 8.0
  - enterprise_linux_desktop = 7.0
  - enterprise_linux_eus = 8.4
  - enterprise_linux_eus = 8.6
  - enterprise_linux_for_arm64_eus = 8.6
  - enterprise_linux_for_ibm_z_systems = 7.0
  - enterprise_linux_for_ibm_z_systems = 8.0
  - enterprise_linux_for_ibm_z_systems_eus = 8.4
  - enterprise_linux_for_ibm_z_systems_eus = 8.6
  - enterprise_linux_for_power_big_endian = 7.0
  - enterprise_linux_for_power_little_endian = 7.0
  - enterprise_linux_for_power_little_endian = 8.0
  - enterprise_linux_for_power_little_endian_eus = 8.4
  - enterprise_linux_for_power_little_endian_eus = 8.6
  - enterprise_linux_for_scientific_computing = 7.0
  - enterprise_linux_server = 7.0
  - enterprise_linux_server_aus = 8.4
  - enterprise_linux_server_aus = 8.6
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 8.4
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 8.6
  - enterprise_linux_server_tus = 8.4
  - enterprise_linux_server_tus = 8.6
  - enterprise_linux_server_update_services_for_sap_solutions = 8.4
  - enterprise_linux_server_update_services_for_sap_solutions = 8.6
  - enterprise_linux_workstation = 7.0
patched:
  - webkitgtk 2.26.0
  - wpe_webkit 2.26.0
published: '2023-03-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T18:17:08.973'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-8720'
references:
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1876611'
    label: secalert@redhat.com
  - url: 'https://webkitgtk.org/security/WSA-2019-0005.html'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1876611'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://webkitgtk.org/security/WSA-2019-0005.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8720
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
exploited: true
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-01-28T21:22:50.417013Z'
epss: 0.01556
epssPercentile: 0.74407
kev: true
kevDateAdded: '2022-05-23'
kevDueDate: '2022-06-13'
kevRansomware: false
zeroDay: true
ingestedAt: '2026-10-07T18:42:20.875Z'
---

## Overview

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

## Affected

- `webkitgtk < 2.26.0`
- `wpe_webkit < 2.26.0`
- `codeready_linux_builder = 8.0`
- `codeready_linux_builder_eus = 8.4`
- `codeready_linux_builder_eus = 8.6`
- `codeready_linux_builder_for_arm64_eus = 8.0`
- `codeready_linux_builder_for_arm64_eus = 8.4`
- `codeready_linux_builder_for_arm64_eus = 8.6`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.0`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.4`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.6`
- `codeready_linux_builder_for_power_little_endian_eus = 8.0`
- `codeready_linux_builder_for_power_little_endian_eus = 8.4`
- `codeready_linux_builder_for_power_little_endian_eus = 8.6`
- `enterprise_linux = 8.0`
- `enterprise_linux_desktop = 7.0`
- `enterprise_linux_eus = 8.4`
- `enterprise_linux_eus = 8.6`
- `enterprise_linux_for_arm64_eus = 8.6`
- `enterprise_linux_for_ibm_z_systems = 7.0`
- `enterprise_linux_for_ibm_z_systems = 8.0`
- `enterprise_linux_for_ibm_z_systems_eus = 8.4`
- `enterprise_linux_for_ibm_z_systems_eus = 8.6`
- `enterprise_linux_for_power_big_endian = 7.0`
- `enterprise_linux_for_power_little_endian = 7.0`
- `enterprise_linux_for_power_little_endian = 8.0`
- `enterprise_linux_for_power_little_endian_eus = 8.4`
- `enterprise_linux_for_power_little_endian_eus = 8.6`
- `enterprise_linux_for_scientific_computing = 7.0`
- `enterprise_linux_server = 7.0`
- `enterprise_linux_server_aus = 8.4`
- `enterprise_linux_server_aus = 8.6`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6`
- `enterprise_linux_server_tus = 8.4`
- `enterprise_linux_server_tus = 8.6`
- `enterprise_linux_server_update_services_for_sap_solutions = 8.4`
- `enterprise_linux_server_update_services_for_sap_solutions = 8.6`
- `enterprise_linux_workstation = 7.0`

## Remediation

Upgrade past the affected range:

- `webkitgtk 2.26.0`
- `wpe_webkit 2.26.0`