CVE-2025-4091

Memory safety bugs in Mozilla Firefox and Thunderbird allow memory corruption and, with sufficient effort, could lead to arbitrary code execution by an attacker. The vulnerability permits compromise of an affected system’s confidentiality, integrity, and availability, potentially enabling full system takeover. The weakness originates from improper bounds checking (CWE-119) and memory management errors (CWE-120).

Vulnerable to hosts running Mozilla Firefox 137, Firefox ESR 128.9, Mozilla Thunderbird 137, and Thunderbird ESR 128.9. Those same vulnerable packages may also exist on Red Hat Enterprise Linux 8, 9, and various update streams; remediation requires updating the browser or Thunderbird packages to the fixed releases. The CVE does not affect later releases such as Firefox 138 or Firefox ESR 128.10, which contain the patch.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not recorded in the CISA KEV catalog, reflecting its relative novelty and low exploitation risk. However, once the bug is sufficiently understood, an attacker could craft a malicious web page or e‑mail that triggers the memory corruption, leveraging the bug to execute code. Because the description does not specify a particular network or local vector, the attack may require direct user interaction with a vulnerable document or web page. Given the high potential impact and the low current EPSS, organizations should treat the issue as a high‑risk priority yet monitor for new exploit activity.