CVE-2025-3030

Memory corruption bugs were discovered in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. The defects could lead to arbitrary code execution if an attacker supplies crafted data that triggers the corruption, allowing the attacker to gain code execution with the privileges of the user running the browser. The weaknesses involve unsafe buffer handling and use-after-free logic, as indicated by CWE-120 and CWE-416. The impact is a severe compromise of confidentiality, integrity, and availability for the affected user or system.

The vulnerability affects Mozilla Firefox and Thunderbird products running the specified affected versions, namely Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Upgrades to Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 contain the fixes and are required to eliminate the risk. The CVE report lists Red Hat Enterprise Linux platforms in its CPEs, but those are not directly impacted by the bugs in the browser code.

The CVSS score of 8.1 signifies high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not present in CISA's KEV catalog. Likely exploitation would involve an attacker delivering malicious content—such as a web page, a multimedia file, or an email attachment—to a user running an affected browser. Successful exploitation would require the target to open or process the crafted content, after which arbitrary code could run in the browser's context.