An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is heavily sandboxed but has slightly different privileges from the content process. The vulnerability affects multiple versions of Firefox and Thunderbird.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-9179 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted media content over the network to the affected versions of Firefox or Thunderbird. The memory corruption can lead to arbitrary code execution, allowing the attacker to gain control over the affected application.
Affected Products
- Firefox < 142: Affected by memory corruption in the GMP process.
- Firefox ESR < 115.27: Vulnerable to the same memory corruption issue.
- Firefox ESR < 128.14: Also affected by this vulnerability.
- Firefox ESR < 140.2: Vulnerable to exploitation.
- Thunderbird < 142: Affected by the memory corruption issue.
- Thunderbird < 128.14: Vulnerable to exploitation.
- Thunderbird < 140.2: Also affected by this vulnerability.
Mitigation
Users are advised to update their Firefox and Thunderbird applications to the latest versions to mitigate the risk associated with this vulnerability. Regularly checking for updates and applying them promptly can help protect against potential exploits.