Description
Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1.
Published: 2025-02-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a memory safety issue in Firefox 135 that can lead to memory corruption; with sufficient effort, an attacker could potentially execute arbitrary code. This is a type of out‑of‑bounds write or buffer overflow (CWE-120 & CWE-787).

Affected Systems

Mozilla Firefox versions earlier than 135.0.1, specifically all builds of Firefox 135, are affected; later versions including 135.0.1 have the fix applied.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk; the EPSS score of less than 1% suggests low current exploitation probability; the vulnerability is not listed in KEV. Exploitation would require a malicious web page or content that triggers the memory corruption; no known public exploit yet. Given the moderate score and low probability, immediate patching is recommended to mitigate potential code execution risk.

Generated by OpenCVE AI on April 20, 2026 at 18:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Firefox 135.0.1 or later
  • Ensure all browser instances are updated to the latest available version
  • Discontinue use of older Firefox builds (pre‑135.0.1) in the environment

Generated by OpenCVE AI on April 20, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-4789 Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1.
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1. Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1.
Title firefox: Memory safety bugs fixed in Firefox 135.0.1 Memory safety bugs fixed in Firefox 135.0.1

Fri, 28 Mar 2025 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Vendors & Products Mozilla
Mozilla firefox

Wed, 19 Feb 2025 14:00:00 +0000

Type Values Removed Values Added
Title firefox: Memory safety bugs fixed in Firefox 135.0.1
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Feb 2025 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Feb 2025 13:45:00 +0000

Type Values Removed Values Added
Description Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1.
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:31:40.764Z

Reserved: 2025-02-18T13:19:50.261Z

Link: CVE-2025-1414

cve-icon Vulnrichment

Updated: 2025-02-18T20:48:06.492Z

cve-icon NVD

Status : Modified

Published: 2025-02-18T14:15:28.670

Modified: 2026-04-13T15:16:51.410

Link: CVE-2025-1414

cve-icon Redhat

Severity : Important

Publid Date: 2025-02-18T13:39:33Z

Links: CVE-2025-1414 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T18:30:13Z

Weaknesses