CVE-2018-19516

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-12 · updated 2026-06-17
Weakness: CWE-20

Description

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.

Affected products

Kde Applications: before 18.12 — fixed in 18.12

How to fix

Upgrade to a fixed version: Kde Applications 18.12. Check the vendor advisory for mitigations.

References

https://cgit.kde.org/messagelib.git/commit/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp?id=34765909cdf8e55402a8567b48fb288839c61612
https://cgit.kde.org/messagelib.git/commit/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp?id=34765909cdf8e55402a8567b48fb288839c61612

Get alerted when CVE-2018-19516 or the next vulnerability affects your stack