CVE-2025-13016 - Vulnerability Details

- Incorrect boundary conditions in the JavaScript: WebAssembly component

Description

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Published: 2025-11-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Incorrect boundary checks in the JavaScript: WebAssembly component can lead to out‑of‑bounds memory accesses, possibly corrupting memory when malicious content is processed. The flaw aligns with buffer overrun issues and improper error handling.

Affected Systems

Mozilla Firefox and Thunderbird, including ESR versions, are affected in releases older than Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Risk and Exploitability

The CVSS score of 7.5 indicates moderate to high risk, while the EPSS score of less than 1% suggests a low exploitation probability and the vulnerability is not listed in CISA KEV. An attacker might cause memory corruption by delivering a WebAssembly module that violates boundaries, thereby affecting the process that loads the module and potentially compromising user data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.5`	unaffected	≤ 140.*
`145`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.5`	unaffected	≤ 140.*
`145`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*

No data.

Vendor	Product	Confidence	Versions
Mozilla	Firefox	—	—
Mozilla	Firefox Esr	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to Firefox 145 or newer, Firefox ESR 140.5 or newer, Thunderbird 145 or newer, or Thunderbird 140.5 or newer.
If an upgrade cannot be applied immediately, disable WebAssembly globally or enforce a policy that blocks execution except in trusted contexts.
Apply content‑security policies to restrict delivery of untrusted WebAssembly modules.

Generated by OpenCVE AI on April 20, 2026 at 19:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4370-1	firefox-esr security update
Debian DLA	DLA-4372-1	thunderbird security update
Debian DSA	DSA-6054-1	firefox-esr security update
Debian DSA	DSA-6059-1	thunderbird security update
Ubuntu USN	USN-7991-1	Thunderbird vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00034.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1992130
https://nvd.nist.gov/vuln/detail/CVE-2025-13016
https://www.cve.org/CVERecord?id=CVE-2025-13016
https://www.mozilla.org/security/advisories/mfsa2025-87/
https://www.mozilla.org/security/advisories/mfsa2025-88/
https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13016
https://www.mozilla.org/security/advisories/mfsa2025-90/
https://www.mozilla.org/security/advisories/mfsa2025-91/

History

Mon, 13 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description	Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.	Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Tue, 25 Nov 2025 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-703

Wed, 19 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
Description	Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.	Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
References		https://www.mozilla.org/security/advisories/mfsa2025-90/ https://www.mozilla.org/security/advisories/mfsa2025-91/

Mon, 17 Nov 2025 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:firefox:::::esr:::*

Thu, 13 Nov 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 12 Nov 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox Mozilla firefox Esr
Vendors & Products		Mozilla Mozilla firefox Mozilla firefox Esr

Wed, 12 Nov 2025 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2025-13016 https://www.cve.org/CVERecord?id=CVE-2025-13016 https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13016
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Tue, 11 Nov 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.
Title		Incorrect boundary conditions in the JavaScript: WebAssembly component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=1992130 https://www.mozilla.org/security/advisories/mfsa2025-87/ https://www.mozilla.org/security/advisories/mfsa2025-88/

Subscriptions

Mozilla Firefox Firefox Esr

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2025-11-11T15:47:14.370Z

Updated: 2026-04-13T14:26:21.119Z

Reserved: 2025-11-11T15:12:13.864Z

Link: CVE-2025-13016

Vulnrichment

Updated: 2025-11-13T15:13:45.011Z

NVD

Status : Modified

Published: 2025-11-11T16:15:38.677

Modified: 2026-04-13T15:16:42.657

Link: CVE-2025-13016

Redhat

Severity : Important

Publid Date: 2025-11-11T15:47:14Z

Links: CVE-2025-13016 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-20T19:15:15Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object