CVE-2025-5268

Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11

View on CVE.org
Published May 27, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Analysis

AI-generated

Technical impact

The vulnerability is a memory safety issue that can lead to memory corruption in Mozilla's Firefox and Thunderbird applications, specifically in versions 138 and 128.10. The bugs could, with sufficient effort, allow an attacker to execute arbitrary code, compromising the confidentiality, integrity, and availability of the affected system.

Affected Systems

Mozilla Firefox and Thunderbird users running the vulnerable releases—Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10—are impacted. The issue has been addressed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11. Systems using these products should verify their installed version to ensure they are on the fixed releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score is below 1%, suggesting low but non-zero likelihood of exploitation at this time, and the vulnerability is not listed as a known exploited vulnerability in CISA's KEV catalog. The attack path likely involves memory corruption triggered by user-supplied input, potentially allowing a malicious webpage or email attachment to achieve remote code execution if the exploit is successful.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Firefox to version 139 or later, Thunderbird to version 139 or later, and the ESR releases to 128.11 or later.
  • If your environment uses Red Hat Enterprise Linux or Debian, ensure that the latest security updates from the official repositories include the updated browser releases and apply them promptly.
  • Until the update can be deployed, consider disabling or uninstalling add-ons that rely on legacy code paths to reduce the attack surface for potential exploitation.

Generated by OpenCVE AI on April 20, 2026 at 17:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4191-1 firefox-esr security update
Debian DLA Debian DLA DLA-4194-1 thunderbird security update
Debian DSA Debian DSA DSA-5926-1 firefox-esr security update
Debian DSA Debian DSA DSA-5932-1 thunderbird security update
EUVD EUVD EUVD-2025-16340 Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Type Values Removed Values Added
Title firefox: thunderbird: Memory safety bugs Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
Type Values Removed Values Added
Weaknesses CWE-77
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
Description Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139 and Firefox ESR < 128.11. Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_tus:8.6
cpe:/a:redhat:rhel_tus:8.8
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:9.4
Vendors & Products Redhat rhel E4s
Redhat rhel Eus
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.0
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Type Values Removed Values Added
Title firefox: thunderbird: Memory safety bugs
Weaknesses CWE-119
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139 and Firefox ESR < 128.11.
References
Earlier changes (10)
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:29 PM
Reserved
May 27, 2025, 12:29 PM

View source JSON

Updated
Nov 3, 2025, 8:06 PM

JSON

Status
Modified
Published
May 27, 2025, 1:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Moderate
Public date
May 27, 2025, 12:29 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 5:15 PM

JSON