CVEvulnerability
CVE-2025-9181
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2025-08-19
- Last modified
- 2026-10-05
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-457
Description
Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
Affected configurations
• mozilla firefox (< 128.14.0)
• mozilla firefox (< 142.0)
• mozilla firefox (>= 140.0 < 140.2.0)
• mozilla thunderbird (< 128.14.0)
• mozilla thunderbird (< 142.0)
• mozilla thunderbird (>= 140.0 < 140.2.0)
Related
Weakness · CWE (1)
- CWE-457 Use of Uninitialized Variable weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1977130 Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-64/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-66/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-67/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-70/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-71/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-72/ Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html lists.debian.org