CVE-2025-52666 Denial of service in Revive Adserver
An administrator can trigger a fatal PHP error via improper format character handling, disabling the admin console in Revive Adserver.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52666?
CVE-2025-52666 is a low-severity denial of service vulnerability in Revive-Adserver Revive Adserver, published on 20 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.
Weakness: CWE-134
Which versions are affected by CVE-2025-52666?
It affects 1 product.
Products include Revive-Adserver Revive Adserver.
How do I fix CVE-2025-52666?
No fix has been published for CVE-2025-52666 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-52666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52666 exists.
Other vulnerabilities in Revive-Adserver Revive Adserver
- CVE-2016-9124 Security feature bypass in Revive Adserver All versions before 3.2.3
- CVE-2016-9125 Auth bypass in Revive Adserver All versions before 3.2.3
- CVE-2017-5830 Deserialization in n/a
- CVE-2016-9470 Other in Revive Adserver All versions before 3.2.5 and 4.0.0
- CVE-2026-50741 Code injection in Adserver
Sources
Also known as GHSA-78v8-2mcw-xgcf.