CVE-2025-13025CWE-276

CVE-2025-13025

High · published November 11, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

⚡ A boundary oversight in WebGPU could lead to performance issues that are more than just a minor hiccup! 🔥 Think of it like a high-speed train racing toward a junction without proper signals; if it miscalculates the intersection, it might derail instead of slowing down. In the same way, this vulnerability can allow unexpected behavior or crashes if boundary conditions aren't correctly handled. An attacker could exploit this vulnerability to trigger severe performance degradation or crashes in affected applications, resulting in a frustrating user experience. If exploited, this could lead to denial of service in the affected programs, causing total disruption and potential data loss!

Put simply

Think of it like a high-speed train racing toward a junction without proper signals; if it miscalculates the intersection, it might derail instead of slowing down. In the same way, this vulnerability can allow unexpected behavior or crashes if boundary conditions aren't correctly handled. This vulnerability stems from incorrect boundary conditions in the Graphics: WebGPU component found in Firefox and Thunderbird, which could allow for unexpected behavior due to improper handling of graphical operations.

What to do

An attacker could exploit this vulnerability to trigger severe performance degradation or crashes in affected applications, resulting in a frustrating user experience. If exploited, this could lead to denial of service in the affected programs, causing total disruption and potential data loss! To secure your systems, update Firefox and Thunderbird to versions 145 or later immediately. It’s essential to ensure that your users have the latest versions to avoid potential disruptions! You've got this! 🚀 Stay ahead of vulnerabilities with timely updates and you'll keep your systems running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-11-11T21:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 145.0145.0
References (3)
EPSS history
Timeline
  • 11 NOV 15:47Z
    Incorrect boundary conditions in the Graphics: WebGPU component
    cvelistv5