CVE-2025-1937highCWE-1260

CVE-2025-1937: high-severity vulnerability in Mozilla Firefox

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

Published · Updated

Follow this CVE+ Monitor Firefox+ Monitor Thunderbird

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
In short

Firefox and Thunderbird contained memory safety bugs that could allow attackers to crash the application or potentially run malicious code if exploited. Updating to the latest version fixes these vulnerabilities.

Technical detail

Memory safety vulnerabilities (CWE-1260) in Firefox 135, Thunderbird 135, and ESR versions allowed arbitrary code execution through memory corruption. No user interaction is required beyond opening a malicious webpage or email attachment; the bugs reside in the browser/email client's core memory management. Fixed in Firefox 136, Firefox ESR 115.21/128.8, and Thunderbird 136/128.8.

Summary generated and translated by AI from the official description.
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Mozilla · FirefoxMozilla · Thunderbird
Related CVEs — Mozilla Firefox

In the same product, most dangerous first.

CVE-2016-9079HIGHCVE-2016-9079EPSS 87.4%KEVCVE-2019-11708CRITICALCVE-2019-11708EPSS 55.9%KEVCVE-2019-17026HIGHCVE-2019-17026EPSS 46.3%KEVCVE-2019-11707HIGHCVE-2019-11707EPSS 38.0%KEVCVE-2024-9680CRITICALCVE-2024-9680EPSS 23.2%KEVCVE-2022-26485HIGHCVE-2022-26485EPSS 14.3%KEV