Unexpected GC during RegExp bailout processing (Mozilla Firefox)

CVE-2025-1934

MEDIUM 6.5

En bref

Source: NVD
EPSS: EPSS 0.45 % · centile 39 (2026-10-31)
État: PUBLISHED
Publiée: 2025-03-04 13:31 UTC
Mise à jour: 2026-06-04 16:41 UTC
Attribuée par: mozilla
Statut NVD: Modified

Rechercher sur…

Description

It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	CISA-ADP
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

ENISA EUVD · EUVD-2025-7439
GCVE · GCVE-0-2025-1934

Avis du CERT-FR

CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0176 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* < 128.8.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* < 136.0
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* < 128.8.0
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* ≥ 129.0 < 136.0

Produits affectés

Produit	Versions
Mozilla · Firefox	unaffected 128.8 ≤ 128.* ; unaffected 136 ≤ *
Mozilla · Thunderbird	unaffected 128.8 ≤ 128.* ; unaffected 136 ≤ *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Unexpected GC during RegExp bailout processing (Mozilla Firefox)