CVE-2019-8720: WebKitGTK Memory Corruption Vulnerability

Patch now

HIGH 8.8EXPLOITEDWATCHLISTUPGRADEUPGRADEDOWNGRADE

CVE-2019-8720 is a high-severity flaw (CVSS 8.8) affecting webkitgtk, wpe webkit, codeready linux builder, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

Why this priority

High severity
Exploited in the wild (CISA KEV)
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.6% (top 25%)
CISA exploited list	Yes, fix due 2022-06-13
Weakness	CWE-119
Published	2023-03-06
Last modified	2026-10-08

Publisher (CNA): Red Hat, Inc. · Vendor: redhat · webkitgtk · wpewebkit

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-05-23Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-06-13Deadline CISA due date for US federal agencies to patch
2023-03-06 23:15 UTCPublished CVE record published
2026-10-08 10:35 UTCUpdated Record last modified

webkitgtk webkitgtk UPGRADE

Affected: < 2.26.0

Fixed in: 2.26.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy webkitgtk || rpm -q webkitgtk || webkitgtk --version

2. UPGRADE to 2.26.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade webkitgtk

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade webkitgtk

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

wpewebkit wpe webkit UPGRADE

Affected: < 2.26.0

Fixed in: 2.26.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy wpe-webkit || rpm -q wpe-webkit || wpe-webkit --version

2. UPGRADE to 2.26.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade wpe-webkit

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade wpe-webkit

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

redhat codeready linux builder DOWNGRADE

Affected: 8.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.0

1. Check installed version

apt-cache policy codeready-linux-builder || rpm -q codeready-linux-builder || codeready-linux-builder --version

2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder sudo apt install codeready-linux-builder=<VERSION_BEFORE_8.0> sudo apt-mark hold codeready-linux-builder

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder sudo dnf downgrade codeready-linux-builder-<VERSION_BEFORE_8.0> sudo dnf versionlock add codeready-linux-builder

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder eus DOWNGRADE

Affected: 8.4 · 8.6

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.4

1. Check installed version

apt-cache policy codeready-linux-builder-eus || rpm -q codeready-linux-builder-eus || codeready-linux-builder-eus --version

2. No fixed release: DOWNGRADE to a release before 8.4 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-eus sudo apt install codeready-linux-builder-eus=<VERSION_BEFORE_8.4> sudo apt-mark hold codeready-linux-builder-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-eus sudo dnf downgrade codeready-linux-builder-eus-<VERSION_BEFORE_8.4> sudo dnf versionlock add codeready-linux-builder-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder for arm64 eus DOWNGRADE

Affected: 8.0 · 8.4 · 8.6

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.0

1. Check installed version

apt-cache policy codeready-linux-builder-for-arm64-eus || rpm -q codeready-linux-builder-for-arm64-eus || codeready-linux-builder-for-arm64-eus --version

2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-for-arm64-eus sudo apt install codeready-linux-builder-for-arm64-eus=<VERSION_BEFORE_8.0> sudo apt-mark hold codeready-linux-builder-for-arm64-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-for-arm64-eus sudo dnf downgrade codeready-linux-builder-for-arm64-eus-<VERSION_BEFORE_8.0> sudo dnf versionlock add codeready-linux-builder-for-arm64-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder for ibm z systems eus DOWNGRADE

Affected: 8.0 · 8.4 · 8.6

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.0

1. Check installed version

apt-cache policy codeready-linux-builder-for-ibm-z-systems-eus || rpm -q codeready-linux-builder-for-ibm-z-systems-eus || codeready-linux-builder-for-ibm-z-systems-eus --version

2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-for-ibm-z-systems-eus sudo apt install codeready-linux-builder-for-ibm-z-systems-eus=<VERSION_BEFORE_8.0> sudo apt-mark hold codeready-linux-builder-for-ibm-z-systems-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-for-ibm-z-systems-eus sudo dnf downgrade codeready-linux-builder-for-ibm-z-systems-eus-<VERSION_BEFORE_8.0> sudo dnf versionlock add codeready-linux-builder-for-ibm-z-systems-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-8720?

webkitgtk: upgrade to 2.26.0; wpe webkit: upgrade to 2.26.0; codeready linux builder: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-8720 being exploited?

Yes. CVE-2019-8720 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2019-8720 affect?

CVE-2019-8720 affects webkitgtk, wpe webkit, codeready linux builder. Severity is high (CVSS 8.8). A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

How urgent is CVE-2019-8720?

Priority 80/100. High severity; Exploited in the wild (CISA KEV); On your watchlist

Software pages

WebKit vulnerabilities · Apple Safari and WebKit vulnerabilities

Related CVEs

CVE-2023-42843 MEDIUM 4.3 UPGRADE UPGRADE An inconsistent user interface issue was addressed with improved state management
CVE-2023-40397 CRITICAL 9.8 UPGRADE UPGRADE The issue was addressed with improved checks
CVE-2023-39928 HIGH 8.8 DOWNGRADE MITIGATE A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5
CVE-2023-32370 MEDIUM 5.3 UPGRADE UPGRADE A logic issue was addressed with improved validation
CVE-2023-28198 HIGH 8.8 UPGRADE UPGRADE A use-after-free issue was addressed with improved memory management

References

← Back to latest CVEs