CVE-2019-8720
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
Key facts
- CVSS score
- 8.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-119
- EPSS score
- 1.6% (75th percentile)
- In CISA KEV
- Yes, added May 23, 2022
- In EU EUVD
- Yes (EUVD-2019-18110)
- Published
- March 6, 2023
- NVD last modified
- October 8, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
WebKitGTK Memory Corruption Vulnerability
Added to the KEV catalog on May 23, 2022; federal remediation due June 13, 2022.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2019-18110 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 7, 2026.
View on the EU Vulnerability DatabaseAffected products
- redhat / codeready linux builder
- redhat / codeready linux builder eus
- redhat / codeready linux builder eus
- redhat / codeready linux builder for arm64 eus
- redhat / codeready linux builder for arm64 eus
- redhat / codeready linux builder for arm64 eus
- redhat / codeready linux builder for ibm z systems eus
- redhat / codeready linux builder for ibm z systems eus
- redhat / codeready linux builder for ibm z systems eus
- redhat / codeready linux builder for power little endian eus
- redhat / codeready linux builder for power little endian eus
- redhat / codeready linux builder for power little endian eus
- redhat / enterprise linux
- redhat / enterprise linux desktop
- redhat / enterprise linux eus
- redhat / enterprise linux eus
- redhat / enterprise linux eus
- redhat / enterprise linux eus
- redhat / enterprise linux for arm64 eus
- redhat / enterprise linux for ibm z systems
- redhat / enterprise linux for ibm z systems
- redhat / enterprise linux for ibm z systems eus
- redhat / enterprise linux for ibm z systems eus
- redhat / enterprise linux for power big endian
- redhat / enterprise linux for power little endian
- redhat / enterprise linux for power little endian
- redhat / enterprise linux for power little endian eus
- redhat / enterprise linux for power little endian eus
- redhat / enterprise linux for scientific computing
- redhat / enterprise linux server
- redhat / enterprise linux server aus
- redhat / enterprise linux server aus
- redhat / enterprise linux server for power little endian update services for sap solutions
- redhat / enterprise linux server for power little endian update services for sap solutions
- redhat / enterprise linux server tus
- redhat / enterprise linux server tus
- redhat / enterprise linux server update services for sap solutions
- redhat / enterprise linux server update services for sap solutions
- redhat / enterprise linux workstation
- webkitgtk / webkitgtk
- wpewebkit / wpe webkit
Certified products that may be affected
1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.
- Red Hat Enterprise Linux 8.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11309-2024 - archived
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1876611(Issue Tracking, Third Party Advisory)
- https://webkitgtk.org/security/WSA-2019-0005.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8720(US Government Resource)
Last updated October 10, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain