Vulnerability Spotlight: Remote code execution vulnerability in Web Kit Web Audio API

Summary: Cisco Talos discovered a remote code execution vulnerability in WebKit's WebAudio API, tracked as TALOS-2020-1172 and CVE-2020-13558, where a malicious web page can trigger a use-after-free error in the AudioSourceProviderGStreamer functionality of WebKitGTK 2.30.1. Talos confirmed WebKitGTK version 2.30.0 is affected and worked with WebKit under its coordinated disclosure policy to resolve the issue and make an update available.
Key Takeaway: Exploitation requires only that a user visit a crafted web page, so the attack surface is ordinary browsing rather than a targeted intrusion. Talos released Snort rules 56126 and 56127 to detect exploitation attempts, and notes those rules may change as more vulnerability information emerges.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-13558
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026