CVE-2025-4919

Out-of-bounds access when optimizing linear sums

View on CVE.org
Published May 17, 2025 CVSS 3.1 · 8.8 High EPSS 9.1% KEV · Not listed
Description
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.

Analysis

AI-generated

Technical impact

An attacker can cause an out-of-bounds read or write on a JavaScript object by confusing array index sizes, potentially corrupting memory. This flaw could allow the attacker to read sensitive data, alter program state, or crash an affected browser. The weakness is documented as CWE‑125 and CWE‑787.

Affected Systems

Mozilla Firefox versions up to and including 138.0, and Firefox ESR releases older than 128.10.1 and 115.23.1, are affected. Mozilla Thunderbird versions up to and including 138.0.2, and Thunderbird ESR releases older than 128.10.2, are also vulnerable. Packages that embed these browsers on Red Hat Enterprise Linux and derivatives, as listed in the provided CPEs, fall under the same impact scope.

Risk and Exploitability

The CVSS score of 8.8 reflects high severity, while the EPSS score of 9% indicates a moderate exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. Attacks likely require delivery of crafted JavaScript via a web page, meaning the threat is primarily remote but depends on user‑initiated browsing or embedded content.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 138.0.4 or newer, or to Firefox ESR 128.10.1 or 115.23.1.
  • Upgrade Thunderbird to version 138.0.2 or newer, or to Thunderbird ESR 128.10.2.
  • For Red Hat or derivative distributions, update to the latest package that includes Firefox 138.0.4 or newer.
  • Until the update is applied, restrict or filter untrusted JavaScript execution in your environment.

Generated by OpenCVE AI on August 18, 2026 at 15:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4172-1 firefox-esr security update
Debian DLA Debian DLA DLA-4194-1 thunderbird security update
Debian DSA Debian DSA DSA-5932-1 thunderbird security update
EUVD EUVD EUVD-2025-15598 An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox ESR < 115.23.1.
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2. An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
Title firefox: thunderbird: Out-of-bounds access when optimizing linear sums Out-of-bounds access when optimizing linear sums
Type Values Removed Values Added
Metrics epss

{'score': 0.00039}

 epss

{'score': 0.00037}
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_tus:8.6
cpe:/a:redhat:rhel_tus:8.8
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
Vendors & Products Redhat rhel E4s
Redhat rhel Eus
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Type Values Removed Values Added
Title firefox: Out-of-bounds access when optimizing linear sums firefox: thunderbird: Out-of-bounds access when optimizing linear sums
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.0
Type Values Removed Values Added
Description An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, and Firefox ESR < 115.23.1. An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2.
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
Type Values Removed Values Added
Title firefox: Out-of-bounds access when optimizing linear sums
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox ESR < 115.23.1. An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, and Firefox ESR < 115.23.1.
References
Type Values Removed Values Added
Description An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox ESR < 115.23.1.
References
Earlier changes (11)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:25 PM
Reserved
May 17, 2025, 7:40 PM

View source JSON

Updated
Nov 3, 2025, 8:05 PM

JSON

Status
Modified
Published
May 17, 2025, 10:15 PM
Modified
Sep 30, 2026, 6:10 PM

View source JSON

Severity
Important
Public date
May 17, 2025, 9:07 PM

View source Bugzilla JSON

Updated
Aug 18, 2026, 3:15 PM

JSON