CVE-2018-12294

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to...

8.8 HighFix available

CVE-2018-12294 is a high vulnerability (CVSS 8.8) in Webkit Webkitgtk\+, published June 19, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in webkit2gtk 2.20.2-1.

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.33%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: CVE-2018-12294
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: CVE-2018-12294
Updated: 2026-11-02

EUVDEUVD-2018-4268 No score

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: EUVD-2018-4268
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xf2c-wp2f-v3jr 8.8

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to...

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: GHSA-xf2c-wp2f-v3jr
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 8.8

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: CVE-2018-12294
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-12294 8.8

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: DEBIAN-CVE-2018-12294
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-12294 8.8

WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.

Record: UBUNTU-CVE-2018-12294
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

webkit webkitgtk\+

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Debian:12	before 2.20.2-1	2.20.2-1
`webkit2gtk` Debian:13	before 2.20.2-1	2.20.2-1
`webkit2gtk` Debian:14	before 2.20.2-1	2.20.2-1
`webkit2gtk` Ubuntu:16.04:LTS	before 2.20.2-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 18 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.1	2.20.2-0ubuntu0.16.04.1
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`webkit2gtk` Ubuntu:18.04:LTS	before 2.20.2-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 7 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-1	2.20.2-0ubuntu0.18.04.1
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less