The vulnerability CVE-2025-1932 in Mozilla Firefox arises from an inconsistent comparator implementation in the xslt/txNodeSorter module, which could cause out-of-bounds memory access. This issue affects Firefox versions 122 and later. The flaw was reported by Ivan Fratric of Google Project Zero and is classified under CWE-125 (Out-of-bounds Read). The vulnerability was addressed and fixed in Firefox 136 and Firefox ESR 128.8 releases. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation of this vulnerability could allow an attacker to cause out-of-bounds memory access, potentially leading to information disclosure or denial of service conditions. The CVSS vector indicates high confidentiality and availability impacts, but no integrity impact. No known exploits have been reported in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 136 and Firefox ESR 128.8. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since this is a client application vulnerability, patching is the primary recommended mitigation. There is no indication from the vendor advisory that additional mitigations or workarounds are necessary.