cbcvebase.
CVE-2025-1933
published 2025-03-04

CVE-2025-1933: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a…

PriorityP334high7.6CVSS 3.1
AVNACLPRNUIRSUCLILAH
EPSS
0.29%
21.4th percentile
On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Affected

14 ranges
VendorProductVersion rangeFixed in
debianfirefox< firefox 136.0-1 (sid)firefox 136.0-1 (sid)
debianfirefox-esr< firefox 136.0-1 (sid)firefox 136.0-1 (sid)
debianthunderbird< firefox 136.0-1 (sid)firefox 136.0-1 (sid)
mozillafirefox< 115.21.0115.21.0
mozillafirefox< 136.0136.0
mozillafirefox
mozillafirefox>= 0 < 136.0+build3-0ubuntu0.20.04.1136.0+build3-0ubuntu0.20.04.1
mozillafirefox>= 116.0 < 128.8.0128.8.0
mozillathunderbird< 128.8128.8
mozillathunderbird>= 0 < 1:128.8.0esr-1~deb11u11:128.8.0esr-1~deb11u1
mozillathunderbird>= 0 < 1:128.8.0esr-1~deb12u11:128.8.0esr-1~deb12u1
mozillathunderbird>= 0 < 1:128.8.0esr-11:128.8.0esr-1
mozillathunderbird>= 0 < 1:128.8.0esr-11:128.8.0esr-1
mozillathunderbird>= 129.0 < 136.0136.0

CVSS provenance

nvdv3.17.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
osv7.6HIGH
vendor_debian7.6HIGH
vendor_redhat7.6HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.