MFSA-RESERVE-2025-4: High severity thunderbird vulnerability

Q: What is the severity of MFSA-RESERVE-2025-4?

The severity of MFSA-RESERVE-2025-4 is high due to the presence of memory safety bugs that could potentially allow arbitrary code execution.

Q: How do I fix MFSA-RESERVE-2025-4?

To fix MFSA-RESERVE-2025-4, update to the latest version 138 of either Firefox or Thunderbird.

Q: Which versions are affected by MFSA-RESERVE-2025-4?

MFSA-RESERVE-2025-4 affects all versions of Firefox and Thunderbird up to but not including version 138.

Q: Is there any exploit available for MFSA-RESERVE-2025-4?

While there is evidence of memory corruption, we presume that exploiting MFSA-RESERVE-2025-4 would require significant effort and may not have a public exploit.

Q: What products are impacted by MFSA-RESERVE-2025-4?

The products impacted by MFSA-RESERVE-2025-4 are Mozilla Firefox and Mozilla Thunderbird.

Published Apr 29, 2025

Updated

Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Affected Software

2 affected componentsFixes available

Mozilla Thunderbird<138

138

Mozilla Firefox<138

138

Event History

Apr 29, 2025

CVE Published

via Mozilla·12:00 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2025-2817

Frequently Asked Questions

What is the severity of MFSA-RESERVE-2025-4?

The severity of MFSA-RESERVE-2025-4 is high due to the presence of memory safety bugs that could potentially allow arbitrary code execution.

How do I fix MFSA-RESERVE-2025-4?

To fix MFSA-RESERVE-2025-4, update to the latest version 138 of either Firefox or Thunderbird.

Which versions are affected by MFSA-RESERVE-2025-4?