ZDI-25-291: (Pwn2Own) Mozilla Firefox IonMonkey JIT Compiler Integer Overflow Remote Code Execution Vulnerability

Published May 21, 2025

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-4919.

Affected Software

1 affected component

Mozilla Firefox

Event History

May 21, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-25-291?

ZDI-25-291 has a CVSS rating indicating its potential impact on affected systems.

How do I fix ZDI-25-291?

To fix ZDI-25-291, users should update to the latest version of Mozilla Firefox.

What does ZDI-25-291 allow attackers to do?

ZDI-25-291 allows remote attackers to execute arbitrary code on affected installations of Mozilla Firefox.

Is user interaction required to exploit ZDI-25-291?

Yes, user interaction is required as the target must visit a malicious page or open a malicious file.

Which software is affected by ZDI-25-291?

ZDI-25-291 affects installations of Mozilla Firefox.