CVE-2025-5272: Memory safety bugs fixed in Firefox 139 and Thunderbird 139
Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 139 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 139 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 139
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5272?
CVE-2025-5272 has a high severity due to its potential exploitation leading to arbitrary code execution.
How do I fix CVE-2025-5272?
To fix CVE-2025-5272, update to Firefox or Thunderbird version 139 or later.
What versions of Firefox are affected by CVE-2025-5272?
Firefox versions prior to 139 are affected by CVE-2025-5272.
What versions of Thunderbird are impacted by CVE-2025-5272?
Thunderbird versions before 139 are impacted by CVE-2025-5272.
What types of issues does CVE-2025-5272 highlight?
CVE-2025-5272 highlights memory safety bugs that could lead to memory corruption.