CVE-2025-9185

EUVD-2025-25243

19.08.2025, 21:15

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 23%

Affected Products (NVD)

Vendor	Product	Version
mozilla	firefox	𝑥 < 115.27.0
mozilla	firefox	𝑥 < 142.0
mozilla	firefox	128.0 ≤ 𝑥 < 128.14.0
mozilla	firefox	140.0 ≤ 𝑥 < 140.2.0
mozilla	thunderbird	𝑥 < 128.14.0
mozilla	thunderbird	𝑥 < 142.0
mozilla	thunderbird	140.0 ≤ 𝑥 < 140.2.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

firefox

sid	147.0.4-1 fixed

firefox-esr

bookworm	128.14.0esr-1~deb12u1 fixed
bookworm (security)	140.7.0esr-1~deb12u1 fixed
bullseye	vulnerable
bullseye (security)	140.7.0esr-1~deb11u1 fixed
forky	140.7.0esr-1 fixed
sid	140.7.0esr-1 fixed
trixie	140.4.0esr-1~deb13u1 fixed
trixie (security)	140.7.0esr-1~deb13u1 fixed

thunderbird

bookworm	1:140.6.0esr-1~deb12u1 fixed
bookworm (security)	1:140.7.1esr-1~deb12u1 fixed
bullseye	vulnerable
bullseye (security)	1:140.7.1esr-1~deb11u1 fixed
forky	1:140.7.1esr-1 fixed
sid	1:140.7.1esr-1 fixed
trixie	1:140.6.0esr-1~deb13u1 fixed
trixie (security)	1:140.7.1esr-1~deb13u1 fixed

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166

https://www.mozilla.org/security/advisories/mfsa2025-64/

https://www.mozilla.org/security/advisories/mfsa2025-65/

https://www.mozilla.org/security/advisories/mfsa2025-66/

https://www.mozilla.org/security/advisories/mfsa2025-67/

https://www.mozilla.org/security/advisories/mfsa2025-70/

https://www.mozilla.org/security/advisories/mfsa2025-71/

https://www.mozilla.org/security/advisories/mfsa2025-72/

https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html

https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html