{"id":"CVE-2019-8720","kind":"vulnerability","aliases":["CVE-2019-8720"],"related":[],"title":"WebKitGTK WebKitGTK: WebKitGTK Memory Corruption Vulnerability","description":"A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.","summary":"WebKitGTK, the browser engine used by GTK applications, has a memory corruption bug that lets an attacker run code. CISA lists it in its known-exploited catalog, so attacks have been seen in the wild.","severity":"high","cvss":8.8,"epss":0.01556,"exploited":true,"exploited_at":"2022-05-23T00:00:00+00:00","products":[{"name":"WebKitGTK WebKitGTK","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gtk-apps","linux","runtime","webkitgtk"],"not_affected_if":["no-webkitgtk-installed"],"how_to_check":null,"fix":"Apply the vendor's WebKitGTK updates, as CISA instructs; the specific fixed version is unknown from the sources.","status":"open","published_at":"2022-05-23T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:16:04+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:16:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's WebKitGTK updates, as CISA instructs; the specific fixed version is unknown from the sources.","reach":"internet","impact":"high","summary":"WebKitGTK, the browser engine used by GTK applications, has a memory corruption bug that lets an attacker run code. CISA lists it in its known-exploited catalog, so attacks have been seen in the wild.","category":"runtime","who_cares":["webkitgtk","linux","gtk-apps"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code by tricking a user into loading malicious web content","analyst_note":"Find the fixed WebKitGTK versions and the triggering content type (web page or other) in the NVD or vendor advisory for CVE-2019-8720.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-webkitgtk-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2825,"output_tokens":357,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':8A,11A '-8720':9A,12A 'address':84C 'app':18B 'applic':29B 'arbitrari':78C 'attack':38B,51B 'browser':24B 'bug':34B 'catalog':49B 'cisa':41B 'code':40B,79C 'content':73C 'corrupt':5A,33B,88C 'craft':71C 'cve':7A,10A 'engin':25B 'execut':80C 'exploit':15B,48B 'flaw':65C 'found':61C 'gtk':17B,28B 'gtk-app':16B 'handl':83C 'improv':81C 'issu':89C 'known':47B 'known-exploit':46B 'lead':76C 'let':36B 'linux':19B 'list':42B 'malici':70C 'may':75C 'memori':4A,32B,82C,87C 'multipl':86C 'process':69C 'run':39B 'runtim':20B 'seen':54B 'trigger':67C 'use':26B 'vulner':6A,59C 'web':72C 'webkit':63C 'webkitgtk':1A,2A,3A,13A,14A,21B,22B 'wild':57B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-05-23T00:00:00+00:00","kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-8720","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8720","severity":null,"published_at":"2022-05-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2019-8720","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8720","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-8720","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8720","severity":null,"published_at":"2023-03-06T23:15:10+00:00","modified_at":"2026-10-08T10:35:56+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}