# CVE-2025-66287: WebKitGTK buffer overflow via malicious web content

Source: https://junglewise.ai/threats/cve-2025-66287-webkitgtk-buffer-overflow-via-malicious-web-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-04. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-66287 · Severity: high · CVSS 8.8 · Published 2025-12-04

WebKitGTK is a web rendering engine used by various Linux applications to display web content. A security flaw in this engine allows a malicious website to cause the application to crash or potentially execute unauthorized code by mishandling memory. This could lead to the theft of sensitive user data or a complete disruption of the affected application's services.

Technologies: [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-66287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66287 being exploited in the wild.

**How severe is CVE-2025-66287?** High severity, with a CVSS score of 8.8, published 4 December 2025.

**Which products and versions are affected?** Red Hat Enterprise Linux 8 webkit2gtk3 < 0:2.50.3-1.el8_10; Red Hat Enterprise Linux 9 webkit2gtk3 < 0:2.50.3-1.el9_5.

**Is there a fix for CVE-2025-66287?** A patch was published on 2025-12-08: Red Hat released security updates for RHEL 8 and 9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66287 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66287?** Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in WebKitGTK due to improper memory handling when processing web content. An attacker can exploit this by enticing a user to visit a maliciously crafted website, leading to an out-of-bounds write or memory corruption. This vulnerability can result in a denial-of-service (process crash) or potentially arbitrary code execution within the context of the application using the WebKitGTK library. The issue is addressed in WebKitGTK version 2.50.3 and various Red Hat security updates (e.g., RHSA-2025:22789).

## Affected products

- The WebKitGTK Team WebKitGTK < 2.50.3
- Red Hat Red Hat Enterprise Linux 8 webkit2gtk3 < 0:2.50.3-1.el8_10
- Red Hat Red Hat Enterprise Linux 9 webkit2gtk3 < 0:2.50.3-1.el9_5

## Timeline

- 2025-12-04: disclosed
- 2025-12-08: patched: Red Hat released security updates for RHEL 8 and 9.

## References

- [https://github.com/WebKit/WebKit](https://github.com/WebKit/WebKit)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2025:22789](https://access.redhat.com/errata/RHSA-2025:22789)
- [https://access.redhat.com/errata/RHSA-2025:22790](https://access.redhat.com/errata/RHSA-2025:22790)
- [https://access.redhat.com/errata/RHSA-2025:23110](https://access.redhat.com/errata/RHSA-2025:23110)
- [https://access.redhat.com/errata/RHSA-2025:23433](https://access.redhat.com/errata/RHSA-2025:23433)
- [https://access.redhat.com/errata/RHSA-2025:23434](https://access.redhat.com/errata/RHSA-2025:23434)

## Related threats

- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)
- [Red Hat PCP privilege escalation in linux_sockets PMDA](https://junglewise.ai/threats/cve-2026-16526-red-hat-pcp-privilege-escalation-in-linux-sockets-pmda)