CVE-2025-4093

HIGH

Firefox ESR 128.9 and Thunderbird 128.9 - Memory Corruption

Title source: llm

Description

Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.10 and Thunderbird 128.10.

References (4)

Core 4

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html

Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1894100

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-29/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-32/

Scores

CVSS v3 8.1

EPSS 0.0043

EPSS Percentile 62.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-119

Status published

Products (4)

mozilla/firefox < 128.10

Mozilla/Firefox 128.10

mozilla/thunderbird < 128.10.0

Mozilla/Thunderbird 128.10

Published Apr 29, 2025

Tracked Since Feb 18, 2026