CVE-2025-66566 is an information disclosure vulnerability in the lz4-java library component used by JDK Mission Control (jmc), caused by insufficient clearing of output buffers. This flaw could potentially expose sensitive data through residual buffer contents. Red Hat has released an important security update for jmc packages in Red Hat Enterprise Linux 9.6 Extended Update Support to fix this vulnerability. The advisory references Red Hat Bugzilla 2419500 and provides updated package versions for remediation. No CVSS score is provided in the advisory, and no exploits are currently known in the wild.

The vulnerability allows information disclosure due to improper clearing of output buffers in lz4-java, which could lead to unintended exposure of sensitive data handled by JDK Mission Control. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical. There are no known active exploits targeting this vulnerability at this time.

Red Hat has published an official security update (RHSA-2026:0751) that addresses this vulnerability. Users of affected Red Hat Enterprise Linux 9.6 Extended Update Support and related products should apply the updated jmc packages as described in the Red Hat advisory and article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.