CVE-2025-5269

HIGH

Firefox and Thunderbird < 128.11.0 - Out-of-bounds Write

Title source: llm

Description

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.11 and Thunderbird 128.11.

References (5)

Core 5

Core References

Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1924108

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-44/

Mailing List

https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html

Mailing List

https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-46/

Scores

CVSS v3 8.1

EPSS 0.0043

EPSS Percentile 62.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-787

Status published

Products (4)

mozilla/firefox < 128.11.0

Mozilla/Firefox 128.11

mozilla/thunderbird < 128.11.0

Mozilla/Thunderbird 128.11

Published May 27, 2025

Tracked Since Feb 18, 2026