CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 128.13 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8035?
CVE-2025-8035 is classified as a high severity vulnerability due to the potential for memory corruption leading to arbitrary code execution.
How do I fix CVE-2025-8035?
To mitigate CVE-2025-8035, users should update Firefox to version 141 or Firefox ESR to version 128.13 or 140.1.
Which versions of Mozilla products are affected by CVE-2025-8035?
CVE-2025-8035 affects Firefox ESR 128.12, 140.0, Thunderbird ESR 128.12, 140.0, and Firefox 140.
What types of applications are impacted by CVE-2025-8035?
CVE-2025-8035 impacts various Mozilla applications including Firefox and Thunderbird, specifically the ESR (Extended Support Release) versions.
Is CVE-2025-8035 actively exploited in the wild?
As of now, there are no reported active exploits related to CVE-2025-8035, but it is essential to apply patches to prevent potential future exploitation.