CVE-2025-4919: Out-of-bounds access when optimizing linear sums
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138.0.2 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.23.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.10.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 138.0.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.10.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4919?
CVE-2025-4919 has been categorized as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive data.
How do I fix CVE-2025-4919?
To fix CVE-2025-4919, update your Mozilla Firefox ESR to version 115.23.1 or later.
What is the impact of CVE-2025-4919?
CVE-2025-4919 can allow attackers to perform out-of-bounds read or write operations on JavaScript objects, leading to potential data corruption or exposure.
Which versions are affected by CVE-2025-4919?
CVE-2025-4919 affects Firefox ESR versions below 115.23.1.
Who is the vendor associated with CVE-2025-4919?
The vendor associated with CVE-2025-4919 is Mozilla.