CVE-2025-9184

Vulnerability

Overview CVE-2025-9184 is a collection of memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. The Mozilla Foundation Security Advisories confirm that these bugs show evidence of memory corruption, and with enough effort could be exploited to run arbitrary code [1][2][3][4]. The root cause lies in improper handling of memory operations within the browser and email client codebases.

Exploitation and

Attack Surface An attacker would need to lure a user to a malicious website or inject crafted content into a browser-like context. According to the advisories, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail [2][4]. However, in a browser or browser-like environment, the attacker could trigger the memory corruption without authentication, potentially leading to code execution.

Impact

Successful exploitation would allow an attacker to execute arbitrary code in the context of the affected application, compromising confidentiality, integrity, and availability. The CVSS v3 score of 8.1 (High) reflects the serious nature of these vulnerabilities.

Mitigation

Mozilla has fixed these bugs in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2 [1][2][3][4]. Users should update to these versions immediately.