CVE-2025-1934:The vulnerability CVE-2025-1934 is a medium severity issue affecting Mozilla's Firefox, Firefox ESR, and Thunderbird products. It involves unexpected garbage collection during RegExp bailout processing.

splash
Back

Description Preview

The vulnerability CVE-2025-1934 was discovered in Mozilla's Firefox, Firefox ESR, and Thunderbird products. The issue arises when it becomes possible to interrupt the processing of a RegExp bailout and run additional JavaScript. This could potentially trigger garbage collection when the engine was not expecting it, leading to unexpected behavior. The versions affected are Firefox versions less than 136, Firefox ESR versions less than 128.8, and Thunderbird versions less than 136 and 128.8.

Overview

The vulnerability was first published on 2025-03-04 and last updated on 2025-03-25. The vulnerability was assigned by Mozilla. The problem type is described as "Unexpected GC during RegExp bailout processing". The vulnerability has a CVSS base score of 6.5, indicating a medium severity level. The attack vector is network-based, and user interaction is required for the vulnerability to be exploited.

Remediation

Users are advised to update their Firefox, Firefox ESR, and Thunderbird products to the latest versions to mitigate this vulnerability. Specifically, Firefox should be updated to version 136 or later, Firefox ESR to version 128.8 or later, and Thunderbird to versions 136 or 128.8 or later.

References

More information about this vulnerability can be found at the following URLs:

  1. Mozilla Bugzilla
  2. Mozilla Security Advisory 2025-14
  3. Mozilla Security Advisory 2025-16
  4. Mozilla Security Advisory 2025-17
  5. Mozilla Security Advisory 2025-18

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Health Care & Social Assistance
    Health Care & Social Assistance
  2. Public Administration
    Public Administration
  3. Manufacturing
    Manufacturing
  4. Educational Services
    Educational Services
  5. Finance and Insurance
    Finance and Insurance
  6. Transportation & Warehousing
    Transportation & Warehousing
  7. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  8. Utilities
    Utilities
  9. Retail Trade
    Retail Trade
  10. Other Services (except Public Administration)
    Other Services (except Public Administration)
  11. Information
    Information
  12. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  13. Management of Companies & Enterprises
    Management of Companies & Enterprises
  14. Mining
    Mining
  15. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  16. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  17. Accommodation & Food Services
    Accommodation & Food Services
  18. Construction
    Construction
  19. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database