CVE-2023-39928

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Webkit	Webkit	WebKitGTK 2.40.5

References

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-33
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831Third Party Advisory
https://webkitgtk.org/security/WSA-2023-0009.htmlVendor Advisory
https://www.debian.org/security/2023/dsa-5527Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-33
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831Third Party Advisory
https://webkitgtk.org/security/WSA-2023-0009.htmlVendor Advisory
https://www.debian.org/security/2023/dsa-5527Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1831

Timeline

Published: Oct 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-399296.7Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially CVE-2023-39937.5An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16 CVE-2023-399309.8A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is CVE-2023-399326.7Uncontrolled search path in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow a privillaged user to potentially enabl CVE-2023-399334.3Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 product CVE-2023-399358.0Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary O CVE-2023-399367.8In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This coul CVE-2023-399386.1Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary CVE-2023-399399.1SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) CVE-2023-39947.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before CVE-2023-399416.5Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denia CVE-2023-399437.8In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data w