- Vulnerability/
- CVE-2025-4082
CVE-2025-4082
First published: Tue Apr 29 2025(Updated: )
Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <138 | |
| Firefox ESR | <128.10<115.23 | |
| Thunderbird | <138 | |
| Mozilla Thunderbird | <128.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1937097
- https://www.mozilla.org/security/advisories/mfsa2025-28/
- https://www.mozilla.org/security/advisories/mfsa2025-29/
- https://www.mozilla.org/security/advisories/mfsa2025-30/
- https://www.mozilla.org/security/advisories/mfsa2025-31/
- https://www.mozilla.org/security/advisories/mfsa2025-32/
Frequently Asked Questions
What is the severity of CVE-2025-4082?
CVE-2025-4082 has been assessed with a high severity level due to potential privilege escalation risks.
How do I fix CVE-2025-4082?
To fix CVE-2025-4082, update to Firefox or Thunderbird versions 138 or later, or Firefox ESR 129 or later.
Which versions of Firefox are affected by CVE-2025-4082?
CVE-2025-4082 affects Firefox versions below 138 on macOS.
Does CVE-2025-4082 affect Firefox on other operating systems?
No, CVE-2025-4082 specifically affects Firefox for macOS only.
Can CVE-2025-4082 be exploited without user interaction?
Exploitation of CVE-2025-4082 may require the victim to visit a malicious webpage, indicating some user interaction is typically necessary.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/mozilla
- canonical/firefox
- canonical/firefox esr
- canonical/thunderbird
- canonical/mozilla thunderbird