CVE-2025-1011

A bug was discovered in the WebAssembly code generation engine that could cause a crash. The flaw can be exploited by an attacker to execute arbitrary code, compromising the integrity and confidentiality of the system. The weakness manifests as a buffer or code injection error (CWE‑119, CWE‑94) in the way WebAssembly modules are compiled and executed. Accordingly, the impact is potential remote code execution in a user’s process context, which could lead to full system compromise if the application runs with elevated privileges.

The affected software includes Mozilla Firefox (all releases prior to 135 and ESR 128.7) and Mozilla Thunderbird (all releases prior to 135 and ESR 128.7). Any system running these browsers that has not yet applied the vendor’s update is vulnerable.

The CVSS score of 9.8 signals a critical severity, yet the EPSS score is below 1%, implying a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a malicious WebAssembly module served to a user’s browser, so targeting users who visit compromised web pages or load untrusted modules. Although exploit availability is low, the high potential impact warrants urgent attention.