CVE-2018-11646: WebKitGTK+ favicon database null pageURL crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication and no user interaction, plus public exploit code and a very high EPSS score, make this a serious denial-of-service risk despite the absence of KEV listing.

What it is

WebKitGTK+ through 2.21.3 mishandles an unset pageURL in webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp, causing an application crash. The flaw is a null-pointer style handling error that lets a remote, unauthenticated trigger terminate the affected process.

Impact

An attacker can crash the WebKitGTK+ process, causing a denial of service for any application embedding the affected WebKit build. There is no evidence in the record of code execution, data disclosure or data modification.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction required, so the crash can be triggered remotely. The description does not specify the exact delivery path, but the favicon database API is reached through web content handling.

Exploitation

CISA KEV does not list this CVE, but public exploit code is referenced on Exploit-DB and in the GNOME bug report, and EPSS is 0.68563 (99.3rd percentile), indicating a high likelihood of exploitation activity.

What to do

• Upgrade WebKitGTK+ to a version newer than 2.21.3 that contains the fix referenced in the WebKit bug 186164 patch.
• Apply the distribution vendor update (for example the Gentoo GLSA 201808-04 advisory) if you rely on packaged WebKitGTK+.
• If immediate patching is not possible, restrict or disable untrusted web content rendering in applications that embed WebKitGTK+.
• Monitor for repeated crashes of WebKitGTK+-based applications and treat them as potential exploitation attempts.

Detection

• Watch application and system logs for repeated crashes or segfaults in WebKitGTK+ processes, especially those tied to favicon database operations.
• Use endpoint detection to flag crash reports referencing WebKitFaviconDatabase.cpp or the favicon database API.
• Correlate crash events with inbound web content or browsing activity to identify a remote trigger pattern.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.