---
id: CVE-2019-8720
title: A vulnerability was found in WebKit
summary: >-
  A vulnerability was found in WebKit. The flaw is triggered when processing
  maliciously crafted web content that may lead to arbitrary code execution.
  Improved memory handling addresses the multiple memory corruption issues.
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
vendor: webkitgtk
product: webkitgtk
affected:
  - webkitgtk < 2.26.0
  - wpe_webkit < 2.26.0
  - codeready_linux_builder = 8.0
  - codeready_linux_builder_eus = 8.4
  - codeready_linux_builder_eus = 8.6
  - codeready_linux_builder_for_arm64_eus = 8.0
  - codeready_linux_builder_for_arm64_eus = 8.4
  - codeready_linux_builder_for_arm64_eus = 8.6
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.0
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.4
  - codeready_linux_builder_for_ibm_z_systems_eus = 8.6
  - codeready_linux_builder_for_power_little_endian_eus = 8.0
  - codeready_linux_builder_for_power_little_endian_eus = 8.4
  - codeready_linux_builder_for_power_little_endian_eus = 8.6
  - enterprise_linux = 8.0
  - enterprise_linux_desktop = 7.0
  - enterprise_linux_eus = 8.4
  - enterprise_linux_eus = 8.6
  - enterprise_linux_for_arm64_eus = 8.6
  - enterprise_linux_for_ibm_z_systems = 7.0
  - enterprise_linux_for_ibm_z_systems = 8.0
  - enterprise_linux_for_ibm_z_systems_eus = 8.4
  - enterprise_linux_for_ibm_z_systems_eus = 8.6
  - enterprise_linux_for_power_big_endian = 7.0
  - enterprise_linux_for_power_little_endian = 7.0
  - enterprise_linux_for_power_little_endian = 8.0
  - enterprise_linux_for_power_little_endian_eus = 8.4
  - enterprise_linux_for_power_little_endian_eus = 8.6
  - enterprise_linux_for_scientific_computing = 7.0
  - enterprise_linux_server = 7.0
  - enterprise_linux_server_aus = 8.4
  - enterprise_linux_server_aus = 8.6
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 8.4
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 8.6
  - enterprise_linux_server_tus = 8.4
  - enterprise_linux_server_tus = 8.6
  - enterprise_linux_server_update_services_for_sap_solutions = 8.4
  - enterprise_linux_server_update_services_for_sap_solutions = 8.6
  - enterprise_linux_workstation = 7.0
patched:
  - webkitgtk 2.26.0
  - wpe_webkit 2.26.0
published: '2023-03-06'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T10:35:56.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-8720'
references:
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1876611'
    label: secalert@redhat.com
  - url: 'https://webkitgtk.org/security/WSA-2019-0005.html'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1876611'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://webkitgtk.org/security/WSA-2019-0005.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8720
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - cve.org
  - exploit-available
epss: 0.01556
epssPercentile: 0.75042
kev: true
kevDateAdded: '2022-05-23'
kevDueDate: '2022-06-13'
kevRansomware: false
exploited: true
zeroDay: true
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-01-28T21:22:50.417013Z'
ingestedAt: '2026-10-07T18:42:20.875Z'
---

## Overview

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

## Affected

- `webkitgtk < 2.26.0`
- `wpe_webkit < 2.26.0`
- `codeready_linux_builder = 8.0`
- `codeready_linux_builder_eus = 8.4`
- `codeready_linux_builder_eus = 8.6`
- `codeready_linux_builder_for_arm64_eus = 8.0`
- `codeready_linux_builder_for_arm64_eus = 8.4`
- `codeready_linux_builder_for_arm64_eus = 8.6`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.0`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.4`
- `codeready_linux_builder_for_ibm_z_systems_eus = 8.6`
- `codeready_linux_builder_for_power_little_endian_eus = 8.0`
- `codeready_linux_builder_for_power_little_endian_eus = 8.4`
- `codeready_linux_builder_for_power_little_endian_eus = 8.6`
- `enterprise_linux = 8.0`
- `enterprise_linux_desktop = 7.0`
- `enterprise_linux_eus = 8.4`
- `enterprise_linux_eus = 8.6`
- `enterprise_linux_for_arm64_eus = 8.6`
- `enterprise_linux_for_ibm_z_systems = 7.0`
- `enterprise_linux_for_ibm_z_systems = 8.0`
- `enterprise_linux_for_ibm_z_systems_eus = 8.4`
- `enterprise_linux_for_ibm_z_systems_eus = 8.6`
- `enterprise_linux_for_power_big_endian = 7.0`
- `enterprise_linux_for_power_little_endian = 7.0`
- `enterprise_linux_for_power_little_endian = 8.0`
- `enterprise_linux_for_power_little_endian_eus = 8.4`
- `enterprise_linux_for_power_little_endian_eus = 8.6`
- `enterprise_linux_for_scientific_computing = 7.0`
- `enterprise_linux_server = 7.0`
- `enterprise_linux_server_aus = 8.4`
- `enterprise_linux_server_aus = 8.6`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.4`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6`
- `enterprise_linux_server_tus = 8.4`
- `enterprise_linux_server_tus = 8.6`
- `enterprise_linux_server_update_services_for_sap_solutions = 8.4`
- `enterprise_linux_server_update_services_for_sap_solutions = 8.6`
- `enterprise_linux_workstation = 7.0`

## Remediation

Upgrade past the affected range:

- `webkitgtk 2.26.0`
- `wpe_webkit 2.26.0`