CVE-2025-4091

CVE-2025-4091 describes memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. These bugs showed evidence of memory corruption, suggesting that with enough effort they could be exploited to run arbitrary code. The root cause involves unspecified memory corruption issues within the affected software [1][2][3][4].

The exploitation vectors are not detailed, but such memory safety bugs are typically triggered by processing malicious content, such as visiting a crafted webpage or opening a specially designed email in Thunderbird. No additional privileges are required; the vulnerability can be exploited by a remote attacker without authentication.

Successful exploitation could allow an attacker to execute arbitrary code on the victim's system, potentially leading to full compromise of the affected application and the underlying operating system.

Mozilla has addressed these vulnerabilities in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. Users are strongly advised to update to these versions as soon as possible to protect against potential attacks [1][2][3][4].