CVE-2025-66287 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
redhat	CNA	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 19%

Debian Releases

Debian Product

Codename

webkit2gtk

bullseye	vulnerable
trixie	2.50.4-1~deb13u1 ignored
bookworm	2.50.4-1~deb12u1 ignored
bullseye (security)	2.50.4-1~deb11u1 fixed
bookworm (security)	2.50.4-1~deb12u1 fixed
trixie (security)	2.50.4-1~deb13u1 fixed
forky	2.50.4-1 fixed
sid	2.50.4-1 fixed

wpewebkit

bullseye (security)	vulnerable
bullseye	vulnerable
trixie	ignored
bookworm	ignored
forky	2.50.4-1 fixed
sid	2.50.4-1 fixed

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://access.redhat.com/errata/RHSA-2025:22789

https://access.redhat.com/errata/RHSA-2025:22790

https://access.redhat.com/errata/RHSA-2025:23110

https://access.redhat.com/errata/RHSA-2025:23433

https://access.redhat.com/errata/RHSA-2025:23434

https://access.redhat.com/errata/RHSA-2025:23451

https://access.redhat.com/errata/RHSA-2025:23452

https://access.redhat.com/errata/RHSA-2025:23583

https://access.redhat.com/errata/RHSA-2025:23591

https://access.redhat.com/errata/RHSA-2025:23742

https://access.redhat.com/errata/RHSA-2025:23743

https://access.redhat.com/security/cve/CVE-2025-66287

https://bugzilla.redhat.com/show_bug.cgi?id=2418857

https://webkitgtk.org/security/WSA-2025-0009.html