CVE-2025-4091: Buffer Overflow
First published: Tue Apr 29 2025(Updated: )
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird ESR < 128.10.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <138 | |
| Firefox ESR | <128.10 | |
| Thunderbird | <138 | |
| Mozilla Thunderbird | <128.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4091?
CVE-2025-4091 has been classified as a memory safety vulnerability that could potentially allow the execution of arbitrary code.
How do I fix CVE-2025-4091?
To resolve CVE-2025-4091, update Firefox to version 138 or newer, and Thunderbird to version 139 or newer.
What software is affected by CVE-2025-4091?
CVE-2025-4091 affects Mozilla Firefox versions below 138, Firefox ESR versions below 128.10, and Thunderbird versions below 138.
What types of bugs are associated with CVE-2025-4091?
CVE-2025-4091 is associated with memory safety bugs that exhibit evidence of memory corruption.
Can CVE-2025-4091 be exploited?
While CVE-2025-4091 shows potential for exploitation, it requires significant effort to achieve arbitrary code execution.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/event
- vendor/mozilla
- canonical/firefox
- canonical/firefox esr
- canonical/thunderbird
- canonical/mozilla thunderbird