PT-2025-42717 · Librewolf +1 · Librewolf +1

Published 2025-10-19 · Updated 2025-10-24 · CVE-2025-11940

Positive Technologies · (AI Summary)

CVSS v3.1

7.0

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreWolf versions prior to 144.0-1

Description A security issue exists in LibreWolf on Windows, affecting the file

assets/setup.nsi

within the Installer component. This allows for uncontrolled search path manipulation through an unknown function. The attack requires local access and is considered highly complex with difficult exploitability.

Recommendations Upgrade to version 144.0-1 to resolve this issue.

Exploit

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

CVE-2025-11940

Affected Products

Librewolf

Windows

References · 14

• 🔥 https://vuldb.com/?submit.671575 · Exploit
• 🔥 https://github.com/Cyber-Wo0dy/report/blob/main/librewolf/143.0.4-1/librewolf_installer_exe_hijacking.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11940 · Security Note
• https://codeberg.org/librewolf/bsys6/releases/tag/144.0-1 · Patch
• https://codeberg.org/librewolf/bsys6/commit/dd10e31dd873e9cb309fad8aed921d45bf905a55 · Patch
• https://twitter.com/CVEnew/status/1979830359043817961 · Twitter Post
• https://twitter.com/cracbot/status/1981677088236265565 · Twitter Post
• https://vuldb.com/?ctiid.329019 · Note
• https://t.me/CVEtracker/35285 · Telegram Post
• https://t.me/cveNotify/139344 · Telegram Post
• https://vuldb.com/?id.329019 · Note
• https://t.me/cveNotify/139466 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1979840318225707223 · Twitter Post
• https://twitter.com/fernandokarl/status/1979956318707310918 · Twitter Post