Local Code Execution Vulnerability in Firefox for Windows
CVE-2025-5265

4.8MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
27 May 2025

What is CVE-2025-5265?

A security flaw has been identified in the 'Copy as cURL' feature of Firefox for Windows, where the ampersand character is insufficiently escaped. This may allow an attacker to manipulate a user into executing a crafted command, leading to potential local code execution on the user's system. This issue primarily affects specific versions of Firefox and Firefox ESR, which could expose users to unauthorized access and execution of commands.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Firefox < 139

Firefox ESR < 115.24

Firefox ESR < 128.11

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1962301
https://www.mozilla.org/security/advisories/mfsa2025-42/
https://www.mozilla.org/security/advisories/mfsa2025-43/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ameen Basha M K
JSON
.