Red Hat Product Errata RHSA-2026:58564 - Security Advisory Issued: 2026-08-24 Updated: 2026-08-24 RHSA-2026:58564 - Security Advisory Overview Updated Packages Synopsis Important: webkitgtk4 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3. Security Fix(es): Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712) webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720) webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731) webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734) webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2280382 - CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js BZ - 2500519 - CVE-2026-39872 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500520 - CVE-2026-43663 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500521 - CVE-2026-43676 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500522 - CVE-2026-43699 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500523 - CVE-2026-43701 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500524 - CVE-2026-43705 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500525 - CVE-2026-43707 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500526 - CVE-2026-43712 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500527 - CVE-2026-43713 webkitgtk: webkitgtk: Visiting a website may leak sensitive data BZ - 2500528 - CVE-2026-43715 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500529 - CVE-2026-43716 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500530 - CVE-2026-43720 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500531 - CVE-2026-43721 webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data BZ - 2500532 - CVE-2026-43725 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500533 - CVE-2026-43726 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500534 - CVE-2026-43727 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500535 - CVE-2026-43731 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500536 - CVE-2026-43732 webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information BZ - 2500537 - CVE-2026-43734 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500538 - CVE-2026-43740 webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory BZ - 2500539 - CVE-2026-43742 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500540 - CVE-2026-43745 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2520320 - CVE-2026-64787 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination CVEs CVE-2024-4367 CVE-2026-39872 CVE-2026-43663 CVE-2026-43676 CVE-2026-43699 CVE-2026-43701 CVE-2026-43705 CVE-2026-43707 CVE-2026-43712 CVE-2026-43713 CVE-2026-43715 CVE-2026-43716 CVE-2026-43720 CVE-2026-43721 CVE-2026-43725 CVE-2026-43726 CVE-2026-43727 CVE-2026-43731 CVE-2026-43732 CVE-2026-43734 CVE-2026-43740 CVE-2026-43742 CVE-2026-43745 CVE-2026-64787 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM webkitgtk4-2.52.5-1.el7_9.src.rpm SHA-256: d4e03713090bddde1dadb161e0a150c133883f35d5dc84b602a7fbd9456c4672 x86_64 webkitgtk4-2.52.5-1.el7_9.x86_64.rpm SHA-256: 92fde475656e4353d90a7664aa77a402e9b2532c36177010b680ed6d4443093e webkitgtk4-debuginfo-2.52.5-1.el7_9.x86_64.rpm SHA-256: 5fe6004c5e8ca6cd3d8d53c3a8596669cfafc20224da297564096da6a72a02cb webkitgtk4-devel-2.52.5-1.el7_9.x86_64.rpm SHA-256: 2066ff75231b8e48465403358ff709f174e7b80fe022e4bf56fe12b7ad373d61 webkitgtk4-doc-2.52.5-1.el7_9.noarch.rpm SHA-256: cb1b8a71a074c544e9f2b9d8d67444e4a137f04e901532ec18edf535435a5945 webkitgtk4-jsc-2.52.5-1.el7_9.x86_64.rpm SHA-256: 0226d9daa52ba5673721e61e35bb607c0b16a802fc34ac6b273433b7338559f6 webkitgtk4-jsc-devel-2.52.5-1.el7_9.x86_64.rpm SHA-256: 7a29fd4e0543e4a533c27db5696ff45c94a90e2637df972f465f2f4fcbc19c0b Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM webkitgtk4-2.52.5-1.el7_9.src.rpm SHA-256: d4e03713090bddde1dadb161e0a150c133883f35d5dc84b602a7fbd9456c4672 s390x webkitgtk4-2.52.5-1.el7_9.s390x.rpm SHA-256: 942ecc057c28eb122cdc8d70fd8edbc710309f01b4cdbf3de78010a3da0ed971 webkitgtk4-debuginfo-2.52.5-1.el7_9.s390x.rpm SHA-256: 268e457b56dcfe60d01a8eeee924e161ffc877d0bc182580ebd163fe20bb4729 webkitgtk4-debuginfo-2.52.5-1.el7_9.s390x.rpm SHA-256: 268e457b56dcfe60d01a8eeee924e161ffc877d0bc182580ebd163fe20bb4729 webkitgtk4-devel-2.52.5-1.el7_9.s390x.rpm SHA-256: a476b6017adef02b6e5fec7d79e28c3debff422a58c0d81ca8b7bffbdca94368 webkitgtk4-doc-2.52.5-1.el7_9.noarch.rpm SHA-256: cb1b8a71a074c544e9f2b9d8d67444e4a137f04e901532ec18edf535435a5945 webkitgtk4-jsc-2.52.5-1.el7_9.s390x.rpm SHA-256: c44c116b0bae7119631897ae4293a971f509ce8e96b201cfa52eec585264abc4 webkitgtk4-jsc-devel-2.52.5-1.el7_9.s390x.rpm SHA-256: 0acaf6c1640f40e97dea338543c1dfb1ad46dda4f0738f6305b95bc7d8c40f75 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM webkitgtk4-2.52.5-1.el7_9.src.rpm SHA-256: d4e03713090bddde1dadb161e0a150c133883f35d5dc84b602a7fbd9456c4672 ppc64 webkitgtk4-doc-2.52.5-1.el7_9.noarch.rpm SHA-256: cb1b8a71a074c544e9f2b9d8d67444e4a137f04e901532ec18edf535435a5945 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM webkitgtk4-2.52.5-1.el7_9.src.rpm SHA-256: d4e03713090bddde1dadb161e0a150c133883f35d5dc84b602a7fbd9456c4672 ppc64le webkitgtk4-2.52.5-1.el7_9.ppc64le.rpm SHA-256: 9831614564e0fce86f2f9486ed41d2707d324a09cbda1906fb3e9e583575631c webki