Critical severity9.8NVD Advisory· Published May 17, 2025· Updated Apr 13, 2026
CVE-2025-4918
CVE-2025-4918
Description
An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
Affected products
4cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <138.0.4
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <115.23.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <128.10.2
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*range: >=138.0,<138.0.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- www.vicarius.io/vsociety/posts/cve-2025-4918-detect-firefox-out-of-bounds-writenvdExploitThird Party Advisory
- www.vicarius.io/vsociety/posts/cve-2025-4918-mitigate-firefox-out-of-bounds-writenvdExploitThird Party Advisory
- www.mozilla.org/security/advisories/mfsa2025-36/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-37/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-38/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-40/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-41/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
- lists.debian.org/debian-lts-announce/2025/05/msg00024.htmlnvd
- lists.debian.org/debian-lts-announce/2025/05/msg00046.htmlnvd
News mentions
0No linked articles in our index yet.