CVE-2025-49710
published 2025-06-11CVE-2025-49710: An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.74%
54.5th percentile
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 139.0.4-1 (sid) | firefox 139.0.4-1 (sid) |
| mozilla | firefox | < 139.0.4 | 139.0.4 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mozilla Firefox up to 139.0.3 JavaScript Engine OrderedHashTable integer overflow (Nessus ID 238072 / WID-SEC-2025-1850)
vuldb·2026-10-24·CVSS 9.8
CVE-2025-49710 [CRITICAL] Mozilla Firefox up to 139.0.3 JavaScript Engine OrderedHashTable integer overflow (Nessus ID 238072 / WID-SEC-2025-1850)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 139.0.3. This impacts the function OrderedHashTable of the component JavaScript Engine. The manipulation leads to integer overflow.
This vulnerability is traded as CVE-2025-49710. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-64mp-f6ff-c8jm: An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139
ghsa_unreviewed·2025-06-11
CVE-2025-49710 [CRITICAL] CWE-190 GHSA-64mp-f6ff-c8jm: An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139.0.4.
OSV
CVE-2025-49710: An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139
osv·2025-06-11·CVSS 9.8
CVE-2025-49710 [CRITICAL] CVE-2025-49710: An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139.0.4.
Debian
CVE-2025-49710: firefox - An integer overflow was present in `OrderedHashTable` used by the JavaScript eng...
vendor_debian·2025·CVSS 9.8
CVE-2025-49710 [CRITICAL] CVE-2025-49710: firefox - An integer overflow was present in `OrderedHashTable` used by the JavaScript eng...
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139.0.4.
Scope: local
sid: resolved (fixed in 139.0.4-1)
Mozilla
Mozilla Foundation Security Advisory 2025-47: CVE-2025-49710
vendor_mozilla·CVSS 9.8
CVE-2025-49710 [CRITICAL] Mozilla Foundation Security Advisory 2025-47: CVE-2025-49710
Mozilla Foundation Security Advisory 2025-47
CVE: CVE-2025-49710
Product: Firefox
Impact: high
Fixed in: Firefox 139.0.4
No detection rules found.
No public exploits indexed.
Wiz
What is a buffer overflow? Modern attacks and cloud security | Wiz
blogs_wiz·2025-10-30
What is a buffer overflow? Modern attacks and cloud security | Wiz
## What is a buffer overflow?
A buffer overflow is a well-known type of memory corruption vulnerability. When a program tries to write more data into a buffer (a temporary storage space) than it was allocated, the excess data “overflows,” overwriting adjacent memory locations.
This isn't a new flaw; buffer overflows have been around for decades. But they remain a dangerous and relevant threat, even in modern applications and systems. In the cloud, buffer overflow attacks can target services like web APIs or applications running in containers.
Two out-of-bounds access vulnerabilities CWE Top 25 Most Dangerous Software Weaknesses list for 2024: CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read). Not every vulnerability is actually exploited in the wild, of course. But a recent
Wiz
What is a buffer overflow? Modern attacks and cloud security | Wiz
blogs_wiz·2025-10-30
What is a buffer overflow? Modern attacks and cloud security | Wiz
## What is a buffer overflow?
A buffer overflow is a well-known type of memory corruption vulnerability. When a program tries to write more data into a buffer (a temporary storage space) than it was allocated, the excess data “overflows,” overwriting adjacent memory locations.
This isn't a new flaw; buffer overflows have been around for decades. But they remain a dangerous and relevant threat, even in modern applications and systems. In the cloud, buffer overflow attacks can target services like web APIs or applications running in containers.
Two out-of-bounds access vulnerabilities CWE Top 25 Most Dangerous Software Weaknesses list for 2024: CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read). Not every vulnerability is actually exploited in the wild, of course. But a recent
2025-06-11
Published