CVE-2025-1934 — Incorrect Regular Expression in Mozilla Firefox
CWE-185 — Incorrect Regular ExpressionCWE-460 — Improper Cleanup on Thrown Exception13 documents8 sources
Severity
6.5MEDIUMNVD
OSV7.5
EPSS
0.3%
top 48.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 4
Latest updateJul 22
Description
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
4OSV▶
CVE-2025-1934: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engi↗2025-03-04
GHSA▶
GHSA-8454-mw8r-4mjq: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engi↗2025-03-04
📋Vendor Advisories
8Debian▶
CVE-2025-1934: firefox - It was possible to interrupt the processing of a RegExp bailout and run addition...↗2025