CVE-2025-1934

The vulnerability allows an attacker to interrupt the JavaScript RegExp bailout process and run additional script code, which can inadvertently trigger garbage collection when the engine is not expecting it. This unexpected GC can lead to memory corruption or cause the browser or mail client to crash, effectively resulting in a denial of service. The weakness is enumerated as a logic or design error (CWE‑460).

Mozilla Firefox versions earlier than 136 and the ESR 128.8 release, as well as Mozilla Thunderbird versions earlier than 136 and the ESR 128.8 release, are affected. Systems that ship these browsers may be impacted if the vulnerable JavaScript engine is present. Based on the provided CPE data, systems running Red Hat Enterprise Linux 8 or 9 that include the affected Firefox or Thunderbird installations may also be impacted; this inference is derived from the CPEs.

The CVSS base score of 6.5 denotes medium severity. EPSS <1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in CISA KEV, suggesting no confirmed public exploits. The likely attack vector is via malicious web pages or email attachments that load JavaScript containing a RegExp pattern designed to interrupt the bailout, causing unexpected garbage collection and a potential denial of service. Exploitation requires only a vulnerable JavaScript engine and delivery of the crafted script; no special privileges are needed.