PT-2025-39218 · Openssl+4 · Openssl+4

Published 2025-01-01 · Updated 2026-03-03 · CVE-2025-10891

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.207 Chromium versions prior to 140.0.7339.207 Chromium versions prior to 140.0.7339.207-1deb12u1 (Debian bookworm) Chromium versions prior to 140.0.7339.207-1deb13u1 (Debian trixie) Chromium version 141.0.7390.76-alt0.p11.1

Description An integer overflow exists in the V8 JavaScript engine component of Google Chrome and Chromium-based browsers. This issue could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to remote code execution or denial of service. Public proof-of-concept code is available. The vulnerability is due to an integer overflow occurring during the handling of user-hidden fields.

Recommendations Update Google Chrome to version 140.0.7339.207 or later. Update Chromium to version 140.0.7339.207 or later. For Debian bookworm, upgrade Chromium to version 140.0.7339.207-1deb12u1 or later. For Debian trixie, upgrade Chromium to version 140.0.7339.207-1deb13u1 or later. Update Chromium to version 141.0.7390.76-alt0.p11.1 or later.

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-472

CWE-190

Related Identifiers

ALT-PU-2025-13054

BDU:2025-12391

CVE-2025-10891

DSA-6010-1

INFESA-2025_0007

OPENSUSE-SU-2025:15578-1

OPENSUSE-SU-2025:20020-1

Affected Products

Alt Linux

Debian

Google Chrome

Openssl

Red Os

References · 60

• https://security-tracker.debian.org/tracker/CVE-2025-10891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10891 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6010-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12391 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-10891 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20020-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE140 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10891 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15578-1 · Vendor Advisory
• https://twitter.com/ZeroPathLabs/status/1970916104747811054 · Twitter Post