CVE-2025-4918

Published May 17, 2025

Last updated a day ago

Firefox

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-4918 involves an out-of-bounds read or write vulnerability affecting JavaScript `Promise` objects. This vulnerability impacts Firefox versions earlier than 138.0.4, Firefox ESR versions earlier than 128.10.1, and Firefox ESR versions earlier than 115.23.1. The vulnerability stems from the JavaScript Handler component, where manipulating an unknown input leads to an out-of-bounds write. Successful exploitation could compromise confidentiality, integrity, and availability.

Description: An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, and Firefox ESR < 115.23.1.
Source: security@mozilla.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-125

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 51

References