{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1011", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-02-04T07:26:29.564Z", "datePublished": "2025-02-04T13:58:53.239Z", "dateUpdated": "2026-04-13T14:25:12.907Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.7", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "135", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.7", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "135", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]}], "title": "A bug in WebAssembly code generation could result in a crash", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1936454"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-07/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-09/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-10/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-11/"}], "credits": [{"lang": "en", "value": "Nan Wang"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:12.907Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-05T19:01:33.799911Z", "id": "CVE-2025-1011", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T19:02:26.455Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:56:51.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:56:51.660Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-1011", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-05T19:01:33.799911Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T19:02:16.337Z"}}], "cna": {"title": "A bug in WebAssembly code generation could result in a crash", "credits": [{"lang": "en", "value": "Nan Wang"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "128.7", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "135", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "128.7", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "135", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1936454"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-07/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-09/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-10/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-11/"}], "descriptions": [{"lang": "en", "value": "A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.", "supportingMedia": [{"type": "text/html", "value": "A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:12.907Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1011", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:25:12.907Z", "dateReserved": "2025-02-04T07:26:29.564Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-02-04T13:58:53.239Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "B1B11C09-3033-44F5-ACC7-591196075CB1", "versionEndExcluding": "128.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "C08017D5-BBC7-4E01-92D2-CE2E2ED9453A", "versionEndExcluding": "135.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "matchCriteriaId": "F8E84F18-A04E-4E18-8AB6-16EB629F7C84", "versionEndExcluding": "135.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "matchCriteriaId": "0504330C-A82A-4E1E-9774-38CCB3DF8D92", "versionEndExcluding": "128.7.0", "versionStartIncluding": "128.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}, {"lang": "es", "value": "Un error en la generaci\u00f3n de c\u00f3digo de WebAssembly podr\u00eda haber provocado un bloqueo. Es posible que un atacante haya podido aprovecharlo para ejecutar el c\u00f3digo. Esta vulnerabilidad afecta a Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7 y Thunderbird < 135."}], "id": "CVE-2025-1011", "lastModified": "2026-04-13T15:16:49.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-02-04T14:15:31.887", "references": [{"source": "security@mozilla.org", "tags": ["Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1936454"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-07/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-09/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-10/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-11/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:1132", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "firefox-0:128.7.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1283", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:128.7.0-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-02-11T00:00:00Z"}, {"advisory": "RHSA-2025:1292", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:128.7.0-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-02-11T00:00:00Z"}, {"advisory": "RHSA-2025:1133", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:128.7.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1348", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:128.7.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1135", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "firefox-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1339", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1135", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "firefox-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1339", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "thunderbird-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1135", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "firefox-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1339", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "thunderbird-0:128.7.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1136", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "firefox-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1341", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "thunderbird-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1136", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "firefox-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1341", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "thunderbird-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1136", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "firefox-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1341", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "thunderbird-0:128.7.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1137", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "firefox-0:128.7.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1340", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "thunderbird-0:128.7.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1066", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:128.7.0-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-02-05T00:00:00Z"}, {"advisory": "RHSA-2025:1184", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:128.7.0-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-02-10T00:00:00Z"}, {"advisory": "RHSA-2025:1138", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "firefox-0:128.7.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1319", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "thunderbird-0:128.7.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-02-11T00:00:00Z"}, {"advisory": "RHSA-2025:1139", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "firefox-0:128.7.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1317", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "thunderbird-0:128.7.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-02-11T00:00:00Z"}, {"advisory": "RHSA-2025:1140", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "firefox-0:128.7.0-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-02-06T00:00:00Z"}, {"advisory": "RHSA-2025:1318", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "thunderbird-0:128.7.0-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-02-11T00:00:00Z"}], "bugzilla": {"description": "firefox: thunderbird: A bug in WebAssembly code generation could result in a crash", "id": "2343756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343756"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "status": "verified"}, "cwe": "CWE-119", "details": ["A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135."], "name": "CVE-2025-1011", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox-flatpak-container", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird-flatpak-container", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-04T13:58:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-1011\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-1011\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1936454\nhttps://www.mozilla.org/security/advisories/mfsa2025-07/\nhttps://www.mozilla.org/security/advisories/mfsa2025-09/\nhttps://www.mozilla.org/security/advisories/mfsa2025-10/\nhttps://www.mozilla.org/security/advisories/mfsa2025-11/"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-20T18:30:03.057946+00:00", "value": {"mitigation_remediation": ["Upgrade Mozilla Firefox to version 135 or newer, or to ESR\u00a0128.7 or newer.", "Upgrade Mozilla Thunderbird to version 135 or newer, or to ESR\u00a0128.7 or newer.", "Apply the latest security updates from your operating system\u2019s package manager for all installed Mozilla products to ensure the patch is in place."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected software includes Mozilla Firefox (all releases prior to 135 and ESR\u00a0128.7) and Mozilla Thunderbird (all releases prior to 135 and ESR\u00a0128.7). Any system running these browsers that has not yet applied the vendor\u2019s update is vulnerable.", "description_and_impact": "A bug was discovered in the WebAssembly code generation engine that could cause a crash. The flaw can be exploited by an attacker to execute arbitrary code, compromising the integrity and confidentiality of the system. The weakness manifests as a buffer or code injection error (CWE\u2011119, CWE\u201194) in the way WebAssembly modules are compiled and executed. Accordingly, the impact is potential remote code execution in a user\u2019s process context, which could lead to full system compromise if the application runs with elevated privileges.", "risk_and_exploitability": "The CVSS score of 9.8 signals a critical severity, yet the EPSS score is below 1%, implying a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a malicious WebAssembly module served to a user\u2019s browser, so targeting users who visit compromised web pages or load untrusted modules. Although exploit availability is low, the high potential impact warrants urgent attention."}}}}, "created": "2026-04-20T18:30:13.984451+00:00", "updated": "2026-04-20T18:30:13.984467+00:00", "vendors": []}