CVE-2025-9181

The flaw occurs when the JavaScript engine reads memory that has not been initialized. This uninitialized memory read can expose arbitrary data stored in the browser process or cause the browser to crash. The vulnerability corresponds to CWE‑457 (Use of Uninitialized Variable) and CWE‑665 (Buffer Access with Incorrect Length Value). The official description does not state that the flaw enables direct code execution; the primary consequence is therefore the potential leakage of sensitive information or unintended denial of service.

Mozilla Firefox and Mozilla Thunderbird are affected. Unpatched releases include Firefox 142 and the ESR branches 128.14 and 140.2; Thunderbird 142 and the corresponding ESR releases 128.14 and 140.2. All earlier releases of these products are also vulnerable.

The CVSS score of 6.5 indicates moderate severity while the EPSS score of < 1% points to a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, reinforcing the modest risk assessment. The likely attack vector involves malicious or compromised web pages delivering crafted JavaScript that executes in a user’s browser session; the attacker would need to entice a user to visit a website or otherwise inject the code. Because the flaw does not provide an explicit remote code‑execution path, the risk focuses on potential information disclosure, but the exploitation remains plausible even with the low EPSS score.