[UPDATE] [hoch] WebKitGTK: Mehrere Schwachstellen
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Ein Angreifer kann mehrere Schwachstellen in WebKitGTK ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen oder andere nicht spezifizierte Angriffe durchzuführen.
CSIRTS triage
- What
- Multiple vulnerabilities in WebKitGTK allow attackers to disclose information, cause denial of service, perform cross-site scripting, bypass security measures, or conduct unspecified attacks.
- Who is affected
- Systems running WebKitGTK across multiple versions.
- Urgency
- Immediate remediation required; vulnerabilities are actively exploited in the wild.
- Action
- Update WebKitGTK to the latest patched version as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch WebKitGTK
Get an email when a new WebKitGTK advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1703
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2025-312731.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2025-312781.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-432110.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2025-432121.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2025-432161.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2025-432271.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-432280.90% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-432400.88% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-432650.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2025-6558Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 95% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-31273 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-31278 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43211 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43212 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43216 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43227 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43228 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43240 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-43265 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-6558 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-24189 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploited[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere Schwachstellencert-bund
- high[UPDATE] [high] Apple macOS Sequoia, Sonoma, and Ventura: Multiple Vulnerabilitiescert-bund
- criticalexploitedCVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerabilitycisa-kev
Recent advisories for WebKitGTK
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[UPDATE] [hoch] WebKitGTK: Schwachstelle ermöglicht Codeausführungcert-bund · 2026-09-15
- high[UPDATE] [hoch] WebKitGTK: Schwachstelle ermöglicht Codeausführungcert-bund · 2026-09-15
- high[UPDATE] [hoch] WebKitGTK: Mehrere Schwachstellencert-bund · 2026-09-14
- medium[UPDATE] [mittel] WebKitGTK: Mehrere Schwachstellencert-bund · 2026-09-04
- high[UPDATE] [hoch] WebKitGTK: Mehrere Schwachstellencert-bund · 2026-09-04
- highexploited[UPDATE] [hoch] WebKitGTK: Mehrere Schwachstellencert-bund · 2026-09-04
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff2026-09-15
- high[NEU] [hoch] MISP: Mehrere Schwachstellen2026-09-15
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service oder unspezifischer Angri…2026-09-15