Cyber Posture

CVE-2025-1942

Critical

Published: 04 March 2025

Published
04 March 2025
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0048 65.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2025-1942 is a critical vulnerability (CVSS 9.8) in the String.toUpperCase() implementation within Mozilla's JavaScript engine, where converting a string to uppercase that results in a longer output could incorporate uninitialized memory into the resulting string (CWE-908). This affects Firefox and Thunderbird versions prior to 136.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U). Successful exploitation enables high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially allowing arbitrary memory read via crafted JavaScript input that triggers the faulty string expansion.

Mozilla addressed the issue in Firefox 136 and Thunderbird 136, as detailed in security advisories MFSA 2025-14 and MFSA 2025-17, along with the upstream bug report at Bugzilla #1947139. Security practitioners should prioritize updating affected browsers to mitigate remote code execution or information disclosure risks.

Details

CWE(s)
CWE-908

Affected Products

mozilla
firefox
≤ 136.0
mozilla
thunderbird
≤ 136.0

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The CVE describes a remote, unauthenticated exploit in the Firefox/Thunderbird JavaScript engine via crafted JS input, enabling drive-by compromise of client applications and direct execution of malicious code or memory disclosure on the victim system.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References