Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142 and Thunderbird < 142.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-9187 |
Exploitation
To exploit this vulnerability, an attacker would need to craft a malicious web page or email that, when accessed by a user, could trigger the memory safety bugs in Firefox or Thunderbird. This could potentially allow the attacker to execute arbitrary code on the user’s system.
Affected Products
- Firefox 141: A web browser that is vulnerable to memory safety issues, allowing potential arbitrary code execution.
- Thunderbird 141: An email client with similar vulnerabilities that could be exploited under certain conditions.
Mitigation
Users are advised to update to Firefox and Thunderbird version 142 or later to mitigate the risks associated with these vulnerabilities. Regularly updating software can help protect against known security issues.