CVE-2025-10533CWE-190

CVE-2025-10533

High · published September 16, 2025

CVSS v3.1

8.8

EPSS

Percentile

54.6

In the wild

Unconfirmed

What it is

Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00754 · 54.6th percentile
Weakness: CWE-190 · Integer Overflow or Wraparound
Published: 2025-09-16T17:15Z

Affected products (5)

Product	Versions	Fixed in
mozilla/firefox	< 115.28.0	115.28.0
mozilla/firefox	< 143.0	143.0
mozilla/firefox	≥ 116.0, < 140.3	140.3
mozilla/thunderbird	< 140.3.0	140.3.0
mozilla/thunderbird	≥ 141.0, < 143.0	143.0

References (7)

https://www.mozilla.org/security/advisories/mfsa2025-74/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-75/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-77/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-78/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html · af854a3a-2127-422b-91ae-364da2661108 https://bugzilla.mozilla.org/show_bug.cgi?id=1980788 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-73/ · [email protected]

EPSS history

Timeline

16 SEP 12:26Z
Integer overflow in the SVG component
cvelistv5