CVE-2025-1934

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-19354.3A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firef CVE-2025-19367.3jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content fr CVE-2025-19377.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs CVE-2025-19386.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of CVE-2025-19393.9Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to tri CVE-2025-19407.1A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in CVE-2025-19419.1Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct CVE-2025-19429.8When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. CVE-2025-19438.2Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2025-19446.5picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTo CVE-2025-19459.8picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. CVE-2025-19469.8A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the functi