Cyber Posture

CVE-2025-1933

High

Published: 04 March 2025

Published
04 March 2025
Modified
13 April 2026
KEV Added
Patch
CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
EPSS Score 0.0049 65.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2025-1933 is a type confusion vulnerability in the WebAssembly (WASM) Just-In-Time (JIT) compiler on 64-bit CPUs. When compiling i32 return values, the JIT can inadvertently incorporate bits from leftover memory, potentially causing the values to be treated as a different type. This affects Mozilla Firefox versions prior to 136, Firefox ESR prior to 115.21 and 128.8, Thunderbird prior to 136 and 128.8.

Remote attackers can exploit this vulnerability over the network with low complexity and no privileges required, but it necessitates user interaction, such as visiting a malicious site hosting crafted WASM code. Successful exploitation yields low confidentiality and integrity impacts alongside high availability impact, as scored at CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), potentially enabling denial-of-service or limited data tampering.

Mozilla's security advisories (MFSA 2025-14 through 17) and the associated Bugzilla entry detail the fix, recommending immediate upgrades to Firefox 136, Firefox ESR 115.21 or 128.8, Thunderbird 136, or Thunderbird 128.8 to mitigate the issue. No additional workarounds are specified in the available information.

Details

CWE(s)
NVD-CWE-noinfo

Affected Products

mozilla
firefox
≤ 115.21.0 · ≤ 136.0 · 116.0 — 128.8.0
mozilla
thunderbird
≤ 128.8 · 129.0 — 136.0

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Browser-based type confusion in WASM JIT enables remote exploitation via user visiting malicious site (drive-by compromise) to achieve client execution, potentially leading to DoS or tampering.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References