CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.26 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.26 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8034?
CVE-2025-8034 is classified as a critical vulnerability due to the potential for memory corruption exploitation.
How do I fix CVE-2025-8034?
To mitigate CVE-2025-8034, update your affected software to the latest versions: Firefox ESR 115.26, 128.13, 140.1, or Firefox 141.
Which software versions are affected by CVE-2025-8034?
CVE-2025-8034 affects Firefox ESR versions 115.25, 128.12, 140.0, Thunderbird ESR versions 128.12, 140.0, and Firefox version 140.
What types of issues are associated with CVE-2025-8034?
CVE-2025-8034 involves memory safety bugs that may lead to memory corruption.
Is user data at risk due to CVE-2025-8034?
Yes, because of its memory corruption nature, CVE-2025-8034 could potentially lead to unauthorized access to user data.