A flaw in WebKitGTK occurs while processing malicious web content. The flaw arises from improper memory handling during the parsing of the full featurelist array in the OpenType vertical data feature lookup. The consequence is memory corruption. The CVE description explicitly states that malicious content can cause memory corruption; it does not mention a crash or code execution. The weakness involved is an unchecked buffer operation, identified as CWE-120.

Red H​at Enterprise Linux 6 through 9 are affected. In RHEL 7, packages such as evolution-data-server, glade, gnome-boxes, gnome‑initial‑setup, gnome‑online‑accounts, gnome‑shell, shotwell, sushi, and yelp depend on WebKitGTK4. WebKitGTK3 is not required by any packaged application. The vulnerability can be exploited only when these packages are present and an untrusted web page is processed through a graphical session, for example GNOME. In the special case of gnome‑shell, a local attacker can trigger the flaw from the local network without user interaction.

The CVSS score of 8.8 indicates high severity. EPSS data is not available, so the exact likelihood is uncertain but the vendor advisory notes that exploitation can occur from a local network in a GNOME session. The flaw is not reported in the CISA KEV catalog, suggesting no known widespread exploitation at the time. The attack vector is local, requiring the target to be running a GNOME interface and loading untrusted web content through a WebKitGTK application.