CVE-2025-1934 Details
Description
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
A vulnerability exists in Mozilla Firefox versions prior to 136, Firefox ESR versions prior to 128.8, and Thunderbird versions prior to 136 and 128.8 ESR. This issue allows for the interruption of RegExp bailout processing, enabling the execution of additional JavaScript. Such interference could trigger garbage collection at unexpected times, potentially leading to memory management issues.
Users can upgrade to Firefox 136, Firefox ESR 128.8, or Thunderbird 136 or 128.8 ESR to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html | CVE | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1942881 | [email protected] | Issue TrackingPermissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-14/ | [email protected] | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-16/ | [email protected] | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-17/ | [email protected] | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-18/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mozilla firefox | < 128.8.0 < 136.0 |
CPE
Remediation
| |
| mozilla thunderbird | < 128.8.0 >= 129.0, < 136.0 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Apr 3, 2025 | Initial Analysis | [email protected] |
| Mar 25, 2025 | CVE Modified | CISA-ADP |
| Mar 12, 2025 | CVE Modified | CISA-ADP |
| Mar 5, 2025 | CVE Modified | [email protected] |
| Mar 4, 2025 | CVE Modified | CISA-ADP |
| Mar 4, 2025 | New CVE Received | [email protected] |