ZDI-CAN-27172: ZDI-25-291: (Pwn2Own) Mozilla Firefox IonMonkey JIT Compiler Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-4919.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-27172?
ZDI-CAN-27172 has been assessed with a high severity rating, indicating a significant risk to affected installations.
How do I fix ZDI-CAN-27172?
To mitigate ZDI-CAN-27172, update Mozilla Firefox to the latest version as released by the vendor.
What types of attacks can be executed via ZDI-CAN-27172?
ZDI-CAN-27172 allows for remote code execution, which means attackers can execute arbitrary code on the victim's system.
What is required for an attacker to exploit ZDI-CAN-27172?
Exploitation of ZDI-CAN-27172 requires user interaction, such as visiting a malicious web page or opening a compromised file.
Which versions of Firefox are affected by ZDI-CAN-27172?
ZDI-CAN-27172 affects certain versions of Mozilla Firefox, but specifics depend on the vendor's advisories.