CVE-2025-66287

Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

HIGH

8.8

CVSS Score

Published: December 4, 2025 at 04:48 PM UTC

Updated: September 25, 2026 at 11:27 PM UTC

3 products affected across 3 vendorsWebKitEnterprise LinuxWebKitGTK

Using Red Hat Enterprise Linux 6 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 6 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

WebKit · Webkit

80%

All versions

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 0:2.50.3-1.el8_10 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_0 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_2 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_4 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_6 (unaffected)

Vendor states this is fixed in 0:2.50.3-1.el9_7 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el7_9 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_2 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_4 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_6 (unaffected)

Vendor states this is fixed in 0:2.50.3-2.el8_8 (unaffected)

Vendor states this is fixed in 6 (unknown)

WebKitGTK · Webkitgtk

60%

v < 2.50.3

Affected range stops below 2.50.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (14)

VDB Entryx_refsource_REDHAT

Source: cverecord

https://access.redhat.com/security/cve/CVE-2025-66287

Issue Trackingx_refsource_REDHAT

Source: cverecord

https://bugzilla.redhat.com/show_bug.cgi?id=2418857

Source: cverecord

https://webkitgtk.org/security/WSA-2025-0009.html