High severity · published Jun 1, 2018
CVE-2018-11646
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through…
7.5
CVSS
68%
EPSS
No
On KEV
Description
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)68.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webkitgtk+ · Webkitgtk
through 2.21.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11646
Issue Tracking
https://bugs.webkit.org/show_bug.cgi?id=186164
Exploit
https://bugzilla.gnome.org/show_bug.cgi?id=795740
Third Party Advisory
https://security.gentoo.org/glsa/201808-04
Exploit
https://www.exploit-db.com/exploits/44842/
Exploit
https://www.exploit-db.com/exploits/44876/
More from Webkitgtk+
9.8
CVE-2021-1870
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
8.8
CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability
8.8
CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
8.8
CVE-2023-42917
Apple Multiple Products WebKit Memory Corruption Vulnerability
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability