CVE-2025-9181

MEDIUM

Firefox and Thunderbird - Use of Uninitialized Variable in JavaScript Engine

Title source: llm
STIX 2.1

Description

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

References (9)

Core 9

Scores

CVSS v3 6.5
EPSS 0.0034
EPSS Percentile 25.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-457
Status published
Products (10)
mozilla/firefox < 128.14.0
mozilla/firefox < 142.0
Mozilla/Firefox 128.14 - 128.*
Mozilla/Firefox 140.2 - 140.*
Mozilla/Firefox 142
mozilla/thunderbird < 128.14.0
mozilla/thunderbird < 142.0
Mozilla/Thunderbird 128.14 - 128.*
Mozilla/Thunderbird 140.2 - 140.*
Mozilla/Thunderbird 142
Published Aug 19, 2025
Tracked Since Feb 18, 2026