Remote Code Execution in Firefox and Thunderbird WebAssembly JavaScript Component
CVE-2025-13016 is a high-severity memory corruption vulnerability in the JavaScript: WebAssembly component used by Mozilla Firefox and Thunderbird. The provided content states the flaw is caused by incorrect boundary conditions in template-heavy WebAssembly garbage-collection code, with faulty pointer arithmetic during a memory fallback/copy path leading to a stack buffer overflow and writes beyond allocated buffer boundaries. A remote attacker may be able to trigger the bug by causing a target to process malicious WebAssembly content, such as through a crafted webpage in Firefox and potentially crafted email content in Thunderbird. Affected versions are Firefox before 145, Firefox ESR before 140.5, Thunderbird before 145, and Thunderbird ESR before 140.5.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity stack buffer overflow vulnerability in the WebAssembly engine's JavaScript component of Mozilla Firefox and Thunderbird, allowing potential arbitrary code execution.
High-severity stack buffer overflow in Mozilla Firefox/Thunderbird WebAssembly engine (JavaScript component) caused by faulty pointer arithmetic/boundary conditions, enabling remote arbitrary code execution via malicious webpages or crafted Thunderbird content.
A critical remote code execution vulnerability in Mozilla Firefox caused by a stack buffer overflow in the WebAssembly engine’s Garbage Collection memory feature, allowing arbitrary code execution on affected user devices.
A critical Firefox WebAssembly (Wasm) memory flaw affecting a large user base.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.