CVE-2025-4092: Memory safety bugs fixed in Firefox 138 and Thunderbird 138
Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 138 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 138 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 138
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4092?
CVE-2025-4092 has a high severity due to potential memory corruption leading to arbitrary code execution.
How do I fix CVE-2025-4092?
To fix CVE-2025-4092, update Firefox and Thunderbird to version 138 or later.
Which versions are affected by CVE-2025-4092?
CVE-2025-4092 affects Firefox versions earlier than 138 and Thunderbird versions earlier than 138.
Can CVE-2025-4092 be exploited remotely?
Yes, if successfully exploited, CVE-2025-4092 could allow remote attackers to execute arbitrary code.
What are the products affected by CVE-2025-4092?
CVE-2025-4092 affects Mozilla Firefox and Mozilla Thunderbird versions below 138.