CVE-2025-1942: Disclosure of uninitialized memory when .toUpperCase() causes string to get longer
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 136 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 136.0+build3-0ubuntu0.20.04.1 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 136 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 136
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1942?
The severity of CVE-2025-1942 is rated as high due to potential exposure of sensitive information from uninitialized memory.
How do I fix CVE-2025-1942?
To fix CVE-2025-1942, update Mozilla Firefox to version 136 or higher.
What are the implications of CVE-2025-1942?
The implications of CVE-2025-1942 include potential exposure of sensitive data and security risks associated with uninitialized memory.
What versions of Firefox are affected by CVE-2025-1942?
CVE-2025-1942 affects versions of Mozilla Firefox up to and including 136.
Can CVE-2025-1942 lead to code execution?
CVE-2025-1942 does not directly lead to code execution but may expose sensitive information that could be exploited.