What’s Vulnerable › Vulnerabilities

CVE-2025-1011: A bug in WebAssembly code generation could result in a crash

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-04 · updated 2026-10-05
• Weakness: CWE-94

Description

A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Affected products

• Mozilla Firefox: before 128.7.0; before 135.0 — fixed in 128.7.0, 135.0
• Mozilla Thunderbird: before 135.0; from 128.0.1 before 128.7.0 — fixed in 128.7.0, 135.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 128.7.0, 135.0; Mozilla Thunderbird 128.7.0, 135.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1936454
• https://www.mozilla.org/security/advisories/mfsa2025-07/
• https://www.mozilla.org/security/advisories/mfsa2025-09/
• https://www.mozilla.org/security/advisories/mfsa2025-10/
• https://www.mozilla.org/security/advisories/mfsa2025-11/
• https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
• https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html

Get alerted when CVE-2025-1011 or the next vulnerability affects your stack