Red Hat Patches Eleven WebKitGTK Graphics Flaws Across Enterprise Linux 9 Point 4 Systems
Red Hat published security advisory RHSA-2026:95520 on 5 November 2026, delivering an updated webkit2gtk3 package that closes eleven separate CVEs. WebKitGTK is the GTK port of the WebKit web rendering engine, and on Red Hat Enterprise Linux it is embedded not just in browsers but in any desktop or developer application that renders web content, including the Eclipse IDE views mentioned in the advisory. All eleven issues sit in ANGLE, the graphics translation layer inherited from Chromium: CVE-2026-87500, CVE-2026-87512, CVE-2026-87586, CVE-2026-87596, CVE-2026-87602, CVE-2026-87604, CVE-2026-87621, CVE-2026-87648, CVE-2026-87654, CVE-2026-91720 and CVE-2026-91738. Red Hat Product Security rated the combined update as having a Critical security impact. The affected channels are the long-tail RHEL 9.4 streams — Server AUS 9.4 on x86_64, Update Services for SAP Solutions on x86_64 and ppc64le, the four-years-of-updates streams for ARM 64 and IBM Z, and the Extended Life Cycle streams for x86_64, ARM 64, Power little endian and IBM Z. The fixed build is webkit2gtk3-2.54.1-1.el9_4.
Red Hat describes each flaw by weakness class rather than by a worked exploitation chain, and no proof-of-concept code or in-the-wild technique is published in the advisory. The arbitrary code execution issues break down into a use-after-free pair (CVE-2026-87512 and CVE-2026-87648), a buffer overflow (CVE-2026-87654), an out-of-bounds read path (CVE-2026-87604) and two further execution flaws reached through a crafted HTML page (CVE-2026-87500 and CVE-2026-87621). The information disclosure set covers an out-of-bounds read (CVE-2026-87596) and two more crafted-page leaks (CVE-2026-87586 and CVE-2026-87602). The remaining two are an improper input validation defect (CVE-2026-91738) and an uninitialized resource defect (CVE-2026-91720). The common thread named in the advisory is attacker-controlled web content processed by the rendering engine, which means the trigger is a page or embedded view rather than a listening network service. The same package also carries a non-security fix for a regression introduced in webkit2gtk3 2.54.0 that broke Eclipse IDE WebKit-based views, tracked as JIRA RHEL-274391.
The practical exposure here is wider than a browser patch sounds. Because webkit2gtk3 is a shared library, the vulnerable rendering code is reachable from help viewers, documentation panes, login portals, email preview panes and IDE components that most asset inventories never classify as browsers, so an organisation can be exposed on a server-class host that nobody considers an internet-facing workstation. The streams covered by this errata are also the conservative ones — AUS, Extended Life Cycle and Update Services for SAP Solutions — which are deliberately slow-moving and frequently underpin production SAP estates where change windows are scarce and reboot opportunities rare. That combination of a memory-corruption cluster in widely linked code and a patch population that historically lags is what makes this advisory worth tracking rather than filing. On current exploitation status, none of the eleven CVEs appears in the CISA Known Exploited Vulnerabilities catalogue, and FIRST EPSS places all of them at well under one percent probability of exploitation in the next thirty days: CVE-2026-87512 is highest at 0.5 percent, CVE-2026-87500, CVE-2026-87621 and CVE-2026-87654 sit at 0.4 percent, CVE-2026-87604, CVE-2026-87648, CVE-2026-91720 and CVE-2026-91738 at 0.3 percent, and CVE-2026-87586, CVE-2026-87596 and CVE-2026-87602 at 0.2 percent. No confirmed exploitation against real targets has been reported for any of them, which places this in the scheduled-maintenance band rather than the emergency one.
Attack Surface
Web Browser, Endpoint OS, Server OS
Tactics
Initial Access, Execution, Collection
Techniques
- T1189 – Drive-by Compromise
- T1203 – Exploitation for Client Execution
- T1005 – Data from Local System
SuperPRO's Threat Countermeasures Procedures
- Update webkit2gtk3 and all sub-packages to 2.54.1-1.el9_4 on every RHEL 9.4 host in the AUS, Extended Life Cycle and Update Services for SAP Solutions streams, using 'dnf update webkit2gtk3 webkit2gtk3-jsc webkit2gtk3-devel' and matching architecture builds for x86_64, ppc64le, aarch64 and s390x.
- Verify the installed build against the SRPM published in RHSA-2026:95520 (webkit2gtk3-2.54.1-1.el9_4.src.rpm, SHA-256 320cac5115cca3e660d1edb354720219270eb0b368a0fb21b3d44e27351a0f9f) so repository mirrors or local rebuilds are not silently serving the vulnerable 2.54.0 package.
- Run 'rpm -q –whatrequires libwebkit2gtk-4.0.so.37' or equivalent library dependency queries across the estate to find non-browser consumers of webkit2gtk3 — Eclipse IDE WebKit views, help viewers and embedded documentation panes — because these hosts carry the same ANGLE flaws without being catalogued as browser endpoints.
- Restart or relaunch long-running processes that have the old webkit2gtk3 shared library mapped after patching; use 'needs-restarting -r' or 'lsof | grep libwebkit2gtk' to confirm no service is still running against the pre-2.54.1 code, which is common on SAP application hosts with rare reboot windows.
- Use Red Hat Lightspeed patch analysis against advisory RHSA-2026:95520 to enumerate affected systems per subscription stream, and raise change requests specifically for AUS and Extended Life Cycle 9.4 hosts, which do not receive the mainline 9.x updates.
- Track the eleven ANGLE CVEs (CVE-2026-87500, CVE-2026-87512, CVE-2026-87586, CVE-2026-87596, CVE-2026-87602, CVE-2026-87604, CVE-2026-87621, CVE-2026-87648, CVE-2026-87654, CVE-2026-91720, CVE-2026-91738) in the vulnerability register with their EPSS values and re-triage immediately if any is added to CISA KEV.
- For hosts that cannot be patched in the current window, restrict which applications are permitted to render untrusted remote web content — disable embedded WebKit browser views in Eclipse and in-application help panes via application policy, since the advisory identifies crafted HTML pages as the trigger for several of these flaws.
