CVE-2025-13021

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-703

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-130229.8Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.CVE-2025-130239.8Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and ThundCVE-2025-130249.8JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.CVE-2025-130257.5Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.CVE-2025-130269.8Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and ThundCVE-2025-130278.1Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-130297.5The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unaCVE-2025-13036.1The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading tCVE-2025-130309.8All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An CVE-2025-130315.9The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privCVE-2025-130327.8Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3  on windows allows local attacker to escalate privelages via pool overfloCVE-2025-130337.5A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An at
CVE-2025-13021: Critical severity, CVSS 9.8 | Vulnix