CVE-2025-10537

Vulnerability

Overview

CVE-2025-10537 is a collection of memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142, and Thunderbird 142. These bugs showed evidence of memory corruption, and Mozilla presumes that with enough effort some could be exploited to run arbitrary code [1][3][4]. The vulnerability was reported by Andrew McCreight and the Mozilla Fuzzing Team [3][4].

Attack

Vector and Prerequisites

Exploitation would require an attacker to craft web content that triggers the memory safety flaw. In the Thunderbird product, scripting is disabled when reading mail, so these flaws cannot be exploited through email directly, but they remain a risk in browser or browser-like contexts [2][3]. No additional authentication or network position is required beyond the ability to serve malicious content to serve malicious content to a vulnerable browser.

Impact

Successful exploitation could allow an attacker to execute arbitrary code on the victim's system, potentially leading to full compromise of the affected application and underlying operating system. The CVSS v3 base score is 8.8 (High) [1].

Mitigation

Mozilla has fixed these bugs in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3 [1][2][3][4]. Users should update to these versions or later to mitigate the risk.