CVE-2025-11940

Katalog CVE

CVSS 7.0 · High EPSS 0,18%

Kerentanan Untrusted Search Path. Skor CVSS 3.1 7.0 (High) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component.

Rincian

Terbit di NVD

19 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.0 (High), sumber vuldb.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path
CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://codeberg.org/librewolf/bsys6/commit/dd10e31dd873e9cb309fad8aed921d45bf905a55
• https://codeberg.org/librewolf/bsys6/releases/tag/144.0-1
• https://github.com/Cyber-Wo0dy/report/blob/main/librewolf/143.0.4-1/librewolf_installer_exe_hijacking.md
• https://vuldb.com/?ctiid.329019
• https://vuldb.com/?id.329019
• https://vuldb.com/?submit.671575