CVE-2025-29699

MediumCVSS 6.5

Published: 03/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

26th percentile - higher than 26% of all known CVEs

Summary

NetSurf 3.11 is vulnerable to use-after-free in the dom_node_set_text_content function. The vulnerability may lead to undefined behavior or potential code execution when processing a crafted page.

Risk Assessment

Browsing a crafted page in NetSurf may cause a browser crash or potential malicious code execution. The risk affects users browsing untrusted content in this browser.

Recommendation

Update NetSurf to a version later than 3.11 if available, or avoid browsing untrusted sites in this browser. Monitor NetSurf project security advisories.

Other vulnerabilities in NetSurf

CVE-2025-45663Medium
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.

Original NVD description (English source)

NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS