{"id":"CVE-2025-66287","state":"PUBLISHED","title":"Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash","description":"A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.","publishedAt":"2025-12-04T16:48:31.485Z","updatedAt":"2026-06-29T20:44:18.481Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["The WebKitGTK Team WebKitGTK","Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"vendor":"The WebKitGTK Team","product":"WebKitGTK","packageName":"webkitgtk","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.50.3","versionType":"semver"}],"collectionURL":"https://github.com/WebKit/WebKit"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"webkitgtk4","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"webkitgtk","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"webkitgtk3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2025:22789","https://access.redhat.com/errata/RHSA-2025:22790","https://access.redhat.com/errata/RHSA-2025:23110","https://access.redhat.com/errata/RHSA-2025:23433","https://access.redhat.com/errata/RHSA-2025:23434","https://access.redhat.com/errata/RHSA-2025:23451","https://access.redhat.com/errata/RHSA-2025:23452","https://access.redhat.com/errata/RHSA-2025:23583","https://access.redhat.com/errata/RHSA-2025:23591","https://access.redhat.com/errata/RHSA-2025:23742","https://access.redhat.com/errata/RHSA-2025:23743","https://access.redhat.com/security/cve/CVE-2025-66287","https://bugzilla.redhat.com/show_bug.cgi?id=2418857","https://webkitgtk.org/security/WSA-2025-0009.html"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/66xxx/CVE-2025-66287.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-66287","state":"PUBLISHED","datePublished":"2025-12-04T16:48:31.485Z","dateUpdated":"2026-06-29T20:44:18.481Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-11-26T19:02:26.116Z"},"containers":{"cna":{"title":"Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash","descriptions":[{"lang":"en","value":"A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling."}],"affected":[{"vendor":"The WebKitGTK Team","product":"WebKitGTK","packageName":"webkitgtk","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.50.3","versionType":"semver"}],"collectionURL":"https://github.com/WebKit/WebKit"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"webkitgtk4","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"webkit2gtk3","defaultStatus":"affected","versions":[{"version":"0:2.50.3-1.el9_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"webkitgtk","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"webkitgtk3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:22789","name":"RHSA-2025:22789","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22790","name":"RHSA-2025:22790","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23110","name":"RHSA-2025:23110","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23433","name":"RHSA-2025:23433","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23434","name":"RHSA-2025:23434","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23451","name":"RHSA-2025:23451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23452","name":"RHSA-2025:23452","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23583","name":"RHSA-2025:23583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23591","name":"RHSA-2025:23591","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23742","name":"RHSA-2025:23742","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23743","name":"RHSA-2025:23743","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66287","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418857","name":"RHBZ#2418857","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://webkitgtk.org/security/WSA-2025-0009.html"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-29T20:44:18.481Z"},"datePublic":"2025-12-04T00:00:00.000Z","x_redhatCweChain":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","workarounds":[{"lang":"en","value":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}],"timeline":[{"lang":"en","time":"2025-12-04T16:04:58.978Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-12-04T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-04T20:55:04.444384Z","id":"CVE-2025-66287","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-04T20:55:34.808Z"}}]}}}