Security Digest: December 10, 2025 - 2 Critical Vulnerabilities

Two high-severity vulnerabilities have been identified today, affecting widely-used software components. Immediate action is required to mitigate potential exploits.

· 3 min read

Today's Critical Security Threats

Executive Summary

Two high-severity vulnerabilities have been identified today, affecting widely-used software components. Immediate action is required to mitigate potential exploits that could compromise application integrity and data security. Upgrade affected software components to the latest secure versions without delay.

Critical Vulnerabilities

CVE-2025-67505: Race Condition in Okta Java SDK

  • Impact: Allows for unintended influence between concurrent requests, potentially altering critical response data used in access control.
  • Affected Systems: Okta Java SDK versions 11.0.0 to 20.0.0, particularly in multithreaded applications using the ApiClient class.
  • Immediate Action: Upgrade to Okta/okta-sdk-java version 21.0.0 or greater.
  • Mitigation: Ensure all multithreaded interactions with the ApiClient class are updated and tested post-upgrade.

CVE-2025-66628: Integer Overflow in ImageMagick TIM Parser

  • Impact: Can lead to arbitrary memory disclosure on 32-bit systems due to out of bounds reads.
  • Affected Systems: ImageMagick packages including Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, and others.
  • Immediate Action: Apply patches from the ImageMagick team addressing this overflow issue.
  • Mitigation: Avoid processing untrusted TIM files until patches are applied.

What to Do Now

  1. Identify all systems using Okta Java SDK and ImageMagick packages. Prioritize upgrades for affected versions.
  2. Upgrade Okta Java SDK to version 21.0.0 or greater.
  3. Apply ImageMagick patches immediately to prevent exploitation of the integer overflow vulnerability.
  4. Validate the effectiveness of upgrades and patches by running security tests and monitoring logs for irregular activity.
  5. Continue to monitor official advisories for additional updates or mitigation strategies.

Related Resources

  • Refer to Okta's official advisory for more details on CVE-2025-67505.
  • Check ImageMagick's GitHub for patch details regarding CVE-2025-66628.

Keep reading