CVE-2025-5272: Memory safety bugs fixed in Firefox 139 and Thunderbird 139
Published May 27, 2025
·Updated
Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
6 affected componentsFixes available
Mozilla Firefox<139
Mozilla Thunderbird<139
Mozilla Thunderbird<139
139
Mozilla Firefox<139
139
Mozilla Firefox<139.0
Mozilla Thunderbird<139.0
Event History
May 27, 2025
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
Updated
via Mozilla·12:00 AM
Affected Software
CVE Published
via MITRE·12:29 PM
Data Sourced
via MITRE·12:29 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2025-5272?
CVE-2025-5272 has a high severity due to its potential exploitation leading to arbitrary code execution.
2
How do I fix CVE-2025-5272?
To fix CVE-2025-5272, update to Firefox or Thunderbird version 139 or later.
3
What versions of Firefox are affected by CVE-2025-5272?
Firefox versions prior to 139 are affected by CVE-2025-5272.
4
What versions of Thunderbird are impacted by CVE-2025-5272?
Thunderbird versions before 139 are impacted by CVE-2025-5272.
5
What types of issues does CVE-2025-5272 highlight?
CVE-2025-5272 highlights memory safety bugs that could lead to memory corruption.