CVE-2025-59251

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-121CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 24, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-592529.3Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose iCVE-2025-592535.5Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.CVE-2025-592547.8Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2025-592557.8Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2025-592576.5Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a nCVE-2025-592586.2Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose informaCVE-2025-592596.5Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a nCVE-2025-59266.1The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due toCVE-2025-592605.5Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disCVE-2025-592617.0Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locallCVE-2025-592685.3On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attackCVE-2025-592696.1A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker
CVE-2025-59251: High severity, CVSS 7.6 | Vulnix