{"id":"CLSA-2026-1791208722","summary":"webkit2gtk3: Fix of 9 CVEs","details":"- CVE-2026-5870: prevent integer overflow in the pixel offset calculations of\n  SkReadPixelsRec/SkWritePixelsRec by routing them through SkSafeMath\n- CVE-2026-7920: stop getRPProgram() mutating the shared SkSL program, which\n  raced with the Ganesh backend reading it and freed IR nodes under it\n- CVE-2026-7923: fix the discard_stack guard in the SkSL raster pipeline\n  builder so it no longer removes more stack entries than the op pushed\n- CVE-2026-10009: bound the number of partial contours in SkPathWriter::assemble\n  so the folded-triangle entry count can no longer overflow\n- CVE-2026-11663: replace the single shared glyph-run builder on SkCanvas with\n  a stack of builders, drop drawable serialization from SkCustomTypeface and\n  restrict the tags deserialized from SkPictures\n- All five are backports into the vendored Skia only; no public API or ABI of\n  the package is touched.","modified":"2026-10-26T09:43:58.570255743Z","published":"2026-10-06T15:17:05Z","upstream":["CVE-2026-10009","CVE-2026-11663","CVE-2026-5870","CVE-2026-7920","CVE-2026-7923"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791208722.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43211"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43227"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43240"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43265"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10009"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11663"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5870"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7920"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7923"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5-1.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791208722.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5-1.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791208722.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5-1.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791208722.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5-1.el9.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791208722.json"}}],"schema_version":"1.9.0"}