CVE-2018-4328

Multiple memory corruption issues were addressed with improved memory handling. This issue...

8.8 HighPublic exploitFix available

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

9.65%Up 2.5 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: CVE-2018-4328
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: CVE-2018-4328
Updated: 2026-11-02

EUVDEUVD-2018-16114 No score

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: EUVD-2018-16114
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2ppg-88hg-fw2j 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue...

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: GHSA-2ppg-88hg-fw2j
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: CVE-2018-4328
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-4328 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: DEBIAN-CVE-2018-4328
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2018-4328 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Record: UBUNTU-CVE-2018-4328
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0081-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.5 fixes the following issues:

Security issues fixed:

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0081-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0059-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.4 fixes the following issues:

Security issues fixed:

CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4416, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386 (bsc#1110279, bsc#1116998).

Record: SUSE-SU-2019:0059-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0092-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.5 fixes the following issues:

Security issues fixed:

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

Record: SUSE-SU-2019:0092-1
Updated: 2026-11-02

OSVUSN-3781-1 No score

webkit2gtk vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Record: USN-3781-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Debian:12	before 2.22.0-2	2.22.0-2
`webkit2gtk` Debian:13	before 2.22.0-2	2.22.0-2
`webkit2gtk` Debian:14	before 2.22.0-2	2.22.0-2
`webkit2gtk3` SUSE:OpenStack Cloud 7 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3

Show 23 moreShow less

Affected packages
Package	Affected	Fixed
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Enterprise Storage 4 From an advisory covering 45 CVEs	before 2.22.4-2.29.3	2.22.4-2.29.3
`webkit2gtk3` SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 43 CVEs	before 2.22.5-3.13.1	2.22.5-3.13.1
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 43 CVEs	before 2.22.5-3.13.1	2.22.5-3.13.1
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`webkit2gtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`webkit2gtk` Ubuntu:18.04:LTS	before 2.22.2-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 10 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.1	2.22.2-0ubuntu0.18.04.1
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known
`webkit2gtk` Ubuntu:18.04:LTS From an advisory covering 24 CVEs	before 2.22.2-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 10 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.1	2.22.2-0ubuntu0.18.04.1
`webkit2gtk3` openSUSE:Leap 15.0 From an advisory covering 43 CVEs	before 2.22.5-lp150.2.9.1	2.22.5-lp150.2.9.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read	2018-09-25

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-4328 is a high vulnerability (CVSS 8.8) in Apple Icloud, published September 28, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.65%, the 95th percentile. Fixed in webkit2gtk 2.22.0-2.

References

Show 91 moreShow less