CVE-2025-4093: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.10 and Thunderbird 128.10.
Other sources
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird ESR < 128.10.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.10 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.10 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 128.10
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4093?
CVE-2025-4093 has the potential for high severity due to the presence of memory corruption that could allow for arbitrary code execution.
How do I fix CVE-2025-4093?
To fix CVE-2025-4093, update Firefox ESR or Thunderbird ESR to version 128.10 or later.
Which versions are affected by CVE-2025-4093?
CVE-2025-4093 affects Firefox ESR versions below 128.10 and Thunderbird ESR versions below 128.10.
What are the consequences of CVE-2025-4093 if left unpatched?
If CVE-2025-4093 is left unpatched, it could potentially be exploited to execute arbitrary code on affected systems.
Is CVE-2025-4093 relevant to all users of Firefox and Thunderbird?
CVE-2025-4093 specifically affects users of Firefox ESR and Thunderbird ESR versions prior to 128.10.