CVE-2025-1011 describes a bug in the WebAssembly code generation component of Mozilla Firefox that could lead to a crash. The vulnerability carries a CVSS 3.1 score of 9.8 (critical), reflecting its potential for remote exploitation without user interaction, resulting in high impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 135 and Firefox ESR 128.7, as well as in Thunderbird versions 128.7 and 135. The vendor advisory explicitly states that the bug could have been leveraged to achieve code execution, but the fix is available in the stated versions.

The vulnerability could allow an attacker to cause a crash in Firefox via crafted WebAssembly code generation. More critically, it may have been exploited to achieve arbitrary code execution remotely without privileges or user interaction. This represents a critical risk to affected systems, potentially allowing full compromise of the browser environment.

Mozilla has released official fixes for this vulnerability in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. Patch status is confirmed by the vendor advisory.