CVE-2025-13016

Published Nov 11, 2025

Last updated 10 days ago

Firefox

Thunderbird

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13016 involves incorrect boundary conditions within the JavaScript: WebAssembly component. This vulnerability affects several software applications. Specifically, the vulnerability impacts Firefox versions earlier than 145, Firefox ESR versions earlier than 140.5, Thunderbird versions earlier than 145, and Thunderbird versions earlier than 140.5.

Description: Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Source: security@mozilla.org
NVD status: Modified
Products: firefox

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-703

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D77916A6-B8C6-475D-8D77-D5D3AA1E1F43",
            "versionEndExcluding": "140.5.0"
          },
          {
            "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "445D5AED-0882-46FE-A5F1-B7148B923221",
            "versionEndExcluding": "145.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.