CVE-2025-3034
First published: Tue Apr 01 2025(Updated: )
Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <137 | 137 |
| Thunderbird | <137 | 137 |
| Firefox | <137.0 | |
| Thunderbird | <137.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1894100%2C1934086%2C1950360
- https://www.mozilla.org/security/advisories/mfsa2025-20/
- https://www.mozilla.org/security/advisories/mfsa2025-23/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-23/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-20/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2025-3034?
CVE-2025-3034 is considered to have a high severity due to potential memory corruption and arbitrary code execution risks.
How do I fix CVE-2025-3034?
To fix CVE-2025-3034, update to the latest versions of Firefox or Thunderbird, specifically version 137 or higher.
What software is affected by CVE-2025-3034?
CVE-2025-3034 affects Firefox versions prior to 137 and Thunderbird versions prior to 137.
What are the potential risks associated with CVE-2025-3034?
The risks include possible exploitation through memory corruption that could lead to arbitrary code execution.
When was CVE-2025-3034 disclosed?
CVE-2025-3034 was disclosed in the security advisories published by Mozilla.
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- agent/event
- agent/softwarecombine
- agent/tags
- agent/software-canonical-lookup-request
- vendor/mozilla
- canonical/thunderbird
- canonical/firefox