CVE-2025-4919: Out-of-bounds access when optimizing linear sums
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.23.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 138.0.4 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.10.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138.0.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.10.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4919?
CVE-2025-4919 has been categorized as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive data.
How do I fix CVE-2025-4919?
To fix CVE-2025-4919, update your Mozilla Firefox ESR to version 115.23.1 or later.
What is the impact of CVE-2025-4919?
CVE-2025-4919 can allow attackers to perform out-of-bounds read or write operations on JavaScript objects, leading to potential data corruption or exposure.
Which versions are affected by CVE-2025-4919?
CVE-2025-4919 affects Firefox ESR versions below 115.23.1.
Who is the vendor associated with CVE-2025-4919?
The vendor associated with CVE-2025-4919 is Mozilla.