CVE-2022-29536: Debian Linux

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Gnome Epiphany: before 41.4 (fixed in 41.4); from 42.0, before 42.2 (fixed in 42.2)

Published 2022-04-20. Last modified 2026-06-17.