Facebook Mvfst vulnerabilities

2 CVEs affecting Facebook Mvfst, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30403, published 2025-07-11.

More from Facebook.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-24029, published 2021-03-15. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message…
• CVE-2025-30403, published 2025-07-11. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.