CVE-2026-83596 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 20.49%

Debian Releases

Debian Product

Codename

webkit2gtk

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	2.54.1-1 fixed
trixie	postponed
trixie (security)	2.54.0-1~deb13u2 fixed

wpewebkit

bookworm	ignored
forky	2.54.0-2 fixed
sid	2.54.1-1 fixed
trixie	ignored

Ubuntu Releases

Ubuntu Product

Codename

webkitgtk

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

Red Hat Enterprise Linux Releases

Red Hat Product

Release

webkit2gtk3

RHEL 8	0:2.54.0-1.el8_10 fixed
RHEL 9	0:2.54.0-1.el9_8 fixed

webkit2gtk3-devel

RHEL 8	0:2.54.0-1.el8_10 fixed
RHEL 9	0:2.54.0-1.el9_8 fixed

webkit2gtk3-jsc

RHEL 8	0:2.54.0-1.el8_10 fixed
RHEL 9	0:2.54.0-1.el9_8 fixed

webkit2gtk3-jsc-devel

RHEL 8	0:2.54.0-1.el8_10 fixed
RHEL 9	0:2.54.0-1.el9_8 fixed

Amazon Linux Releases

Amazon Package

Release

webkitgtk4

Amazon Linux 2

0:2.52.6-1.amzn2.0.2

fixed

webkitgtk4-devel

Amazon Linux 2

0:2.52.6-1.amzn2.0.2

fixed

webkitgtk4-jsc

Amazon Linux 2

0:2.52.6-1.amzn2.0.2

fixed

webkitgtk4-jsc-devel

Amazon Linux 2

0:2.52.6-1.amzn2.0.2

fixed

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://access.redhat.com/errata/RHSA-2026:69098

https://access.redhat.com/errata/RHSA-2026:74084

https://access.redhat.com/security/cve/CVE-2026-83596

https://bugs.webkit.org/show_bug.cgi?id=322969

https://bugzilla.redhat.com/show_bug.cgi?id=2526490