CVE-2025-11940
LibreWolf Installer setup.nsi uncontrolled search path
- State
- Published
- Severity
- 7.3 High
- Published
- Oct 19, 2025
- Updated
- Oct 20, 2025
- Reserved
- Oct 18, 2025
Description
A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C | VulDB |
| 3.0 | 7.0 High | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C | VulDB |
| 2.0 | 6.0 Medium | AV:L/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
LibreWolfn/a |
|
References
- VDB-329019 | LibreWolf Installer setup.nsi uncontrolled search pathvdb-entry
- VDB-329019 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #671575 | LibreWolf Librewolf installer 143.0.4-1 EXE Hijackingthird-party-advisory
- https://github.com/Cyber-Wo0dy/report/blob/main/librewolf/143.0.4-1/librewolf_installer_exe_hijacking.mdrelated
- https://codeberg.org/librewolf/bsys6/commit/dd10e31dd873e9cb309fad8aed921d45bf905a55patch
- https://codeberg.org/librewolf/bsys6/releases/tag/144.0-1patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.