CVE-2025-1937

Memory safety bugs were identified in Firefox 135 and Thunderbird 135, as well as in various ESR releases including Firefox ESR 115.20 and 128.7, and Thunderbird ESR 128.7. The flaws involve improper handling of memory, leading to corruption that could, with sufficient effort, enable an attacker to execute arbitrary code. The weaknesses are classified as CWE-120 (Buffer Copy without Length Checks) and CWE-1260 (Uncontrolled Buffer Size). The impact is the potential compromise of the host system through remote code execution.

The affected products are Mozilla Firefox and Mozilla Thunderbird. Vulnerable versions include Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird ESR 128.7. These products can run on Windows, macOS, Linux, and specifically on Red Hat Enterprise Linux 8 and 9 distributions (including RHEL AUS, E4S, EU S, TUS, and EL S variants) where the pre‑fixed versions are installed. Any installation running one of these pre‑fixed versions, regardless of the operating system, is at risk.

The CVSS score of 7.5 indicates a high severity. EPSS is reported as <1%, suggesting a low current exploitation probability, but the memory corruption nature still allows the possibility of remote code execution through privileged browser actions. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to target the vulnerability via malicious web content or compromised local applications that can trigger the memory defects, though the specific attack vector is not explicitly stated in the available description and is inferred to be remote.