CVE-2025-66287
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A flaw was found in WebKitGTK due to improper memory handling. Processing malicious web content can cause an unexpected process crash.
Risk Assessment
An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by sending a specially crafted web page, potentially disrupting applications using WebKitGTK.
Recommendation
Update WebKitGTK to the latest available version that includes a fix for this vulnerability. Monitor Linux distribution security advisories for official patches.
Other vulnerabilities in WebKitGTK
See all- CVE-2015-2330High
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- CVE-2026-78376High
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
- CVE-2025-13947High
A vulnerability was found in WebKitGTK that allows remote, user-assisted information disclosure. The flaw is due to missing verification of the source of file drag-and-drop operations, enabling an attacker to read any file the user is permitted to access.
- CVE-2025-13502High
A flaw in WebKitGTK and WPE WebKit allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
Original NVD description (English source)
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.