CVE-2025-66287CWE-120

CVE-2025-66287

High · published December 4, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

⚡ A rogue webpage could crash your entire WebKitGTK process! That's right, memory mishandling is the villain of this story, and it's knocking at your door! 🔥 Think of it like a restaurant kitchen where the chef accidentally spills hot soup on the floor. If nobody cleans it up, a server might slip and crash right into the wall — just like this flaw can cause your process to crash when handling tricky content. An attacker could exploit this vulnerability to serve up malicious web content that makes your application stumble and crash unexpectedly. This could lead to service disruptions, and in a worst-case scenario, affect your users' experience and trust. No one likes a website that goes belly-up!

Put simply

Think of it like a restaurant kitchen where the chef accidentally spills hot soup on the floor. If nobody cleans it up, a server might slip and crash right into the wall — just like this flaw can cause your process to crash when handling tricky content. This flaw in WebKitGTK arises from improper memory handling when processing certain web content, which can lead to unexpected crashes of the application utilizing this engine.

What to do

An attacker could exploit this vulnerability to serve up malicious web content that makes your application stumble and crash unexpectedly. This could lead to service disruptions, and in a worst-case scenario, affect your users' experience and trust. No one likes a website that goes belly-up! To mitigate this risk, update WebKitGTK to the latest version as soon as it becomes available. Additionally, avoid loading untrusted web content whenever possible, and consider implementing safeguards in your application to handle unexpected crashes gracefully. You've got this! Stay vigilant and keep your systems updated for a safer browsing experience! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-04T22:15Z
References (14)
EPSS history
Timeline
  • 04 DEC 16:48Z
    Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash
    cvelistv5