Critical Kibana Flaws Enable Heap Corruption and Remote Code Execution

A critical security flaw has been uncovered in Kibana, the popular data visualization platform for the Elastic Stack, exposing organizations to severe risks of heap corruption and potential remote code execution.

The vulnerability, tracked as CVE-2025-2135, carries a CVSS v3.1 score of 9.9, marking it as a critical threat that requires immediate attention from both self-hosted and Elastic Cloud users.

Nature of the Vulnerability

CVE-2025-2135 stems from a Type Confusion vulnerability in Chromium, which underpins Kibana’s reporting engine.

Attackers can exploit this flaw by enticing users to interact with a crafted HTML page, leading to heap memory corruption.

In the worst-case scenario, this corruption can be leveraged to execute arbitrary code on the underlying system, posing a significant risk to data integrity and system security.

Affected Versions and Configurations

The vulnerability affects the following Kibana versions:

• 7.17.28 and earlier
• 8.0.0 up to and including 8.17.7
• 8.18.0 up to and including 8.18.2
• 9.0.0 up to and including 9.0.2

Both self-hosted and Elastic Cloud deployments are at risk, specifically when PDF or PNG reporting features are enabled. CSV reporting and serverless Kibana projects are not impacted.

Immediate Mitigation and Upgrades

Elastic recommends all users upgrade to the fixed versions: 7.17.29, 8.17.8, 8.18.3, or 9.0.3. These releases address the underlying vulnerability and significantly reduce the risk of exploitation.

For organizations unable to upgrade immediately, several mitigations are advised:

• Disable Reporting: Add xpack.reporting.enabled: false to the kibana.yml configuration file.
• Restrict Access: Limit report generation capabilities to trusted accounts only.
• Enforce Network Policies: Implement strict network policies to prevent unauthorized connections between Chromium and Kibana during report generation.

On Elastic Cloud, code execution is confined within the Kibana Docker container, with additional protections such as seccomp-bpf and AppArmor minimizing further exploitation.

Nonetheless, disabling the Reporting feature or restricting access remains strongly recommended for affected deployments.

Given Kibana’s widespread use for monitoring and analytics, the broad attack surface and critical severity of CVE-2025-2135 demand swift action.

Organizations are urged to assess their deployments, apply updates, and implement mitigations without delay to prevent potential exploitation and maintain operational security.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates