CVE-2025-66287: WebKitGTK buffer overflow via malicious web content

CVE-2025-66287 · Severity: high · CVSS 8.8 · Published 2025-12-04

WebKitGTK is a web rendering engine used by various Linux applications to display web content. A security flaw in this engine allows a malicious website to cause the application to crash or potentially execute unauthorized code by mishandling memory. This could lead to the theft of sensitive user data or a complete disruption of the affected application's services.

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2025-66287 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66287 being exploited in the wild.
How severe is CVE-2025-66287?
High severity, with a CVSS score of 8.8, published 4 December 2025.
Which products and versions are affected?
Red Hat Enterprise Linux 8 webkit2gtk3 < 0:2.50.3-1.el8_10; Red Hat Enterprise Linux 9 webkit2gtk3 < 0:2.50.3-1.el9_5.
Is there a fix for CVE-2025-66287?
A patch was published on 2025-12-08: Red Hat released security updates for RHEL 8 and 9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66287 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-66287?
Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in WebKitGTK due to improper memory handling when processing web content. An attacker can exploit this by enticing a user to visit a maliciously crafted website, leading to an out-of-bounds write or memory corruption. This vulnerability can result in a denial-of-service (process crash) or potentially arbitrary code execution within the context of the application using the WebKitGTK library. The issue is addressed in WebKitGTK version 2.50.3 and various Red Hat security updates (e.g., RHSA-2025:22789).

Affected products

  • The WebKitGTK Team WebKitGTK < 2.50.3
  • Red Hat Red Hat Enterprise Linux 8 webkit2gtk3 < 0:2.50.3-1.el8_10
  • Red Hat Red Hat Enterprise Linux 9 webkit2gtk3 < 0:2.50.3-1.el9_5

Timeline

  • 2025-12-04: disclosed
  • 2025-12-08: patched: Red Hat released security updates for RHEL 8 and 9.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.