This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 21 vulnerabilities

Mozilla fixes 21 vulnerabilities. The most severe are listed below. Products and their fixed versions: Firefox - 141 [7] Firefox ESR - 115.26, 128.13, 140.1 [4][5][6] Thunderbird - 128.13, 140.1, 141 [1][2][3]

Mozilla Firefox, Firefox ESR, Thunderbird - data leak (CVE-2025-8027)
CVSS 6.5 (Medium)

An unauthenticated remote attacker can gain unauthorized access to data from memory on the victim's system by having them display a specially crafted page. The vulnerability is exploitable only on a 64-bit platform [1][2][3][4][5][6][7].

The vulnerability is present in products:

  • Mozilla Thunderbird; >=140, <140.1; >=128,13;
  • Mozilla Firefox ESR; >=115, <115.26; >=128, <128.13; >=140, <140.1;
  • Mozilla Firefox; >=140, <141;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 22. 7. 2025.

Mozilla Firefox, Firefox ESR, Thunderbird - memory address miscalculation (CVE-2025-8028)
CVSS 8.8 (High)

An unauthenticated remote attacker can crash the victim's browser and potentially execute code by having them display a specially crafted page. The vulnerability is exploitable only on systems with the ARM64 architecture [1][2][3][4][5][6][7].

The vulnerability is present in products:

  • Mozilla Thunderbird; >=140, <140.1; >=128,13;
  • Mozilla Firefox ESR; >=115, <115.26; >=128, <128.13; >=140, <140.1;
  • Mozilla Firefox; >=140, <141;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 22. 7. 2025.

Mozilla Firefox, Firefox ESR, Thunderbird - memory corruption (CVE-2025-8034)
CVSS 8.8 (High)

An unauthenticated remote attacker can cause memory corruption and potentially execute code [1][2][3][4][5][6][7].

The vulnerability is present in products:

  • Mozilla Thunderbird; >=140, <140.1; >=128, <128,13;
  • Mozilla Firefox ESR; >=115, <115.26; >=128, <128.13; >=140, <140.1;
  • Mozilla Firefox; >=140, <141;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-8034 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 22. 7. 2025.

By CESNET, z.s.p.o. Martin Krajči on 24. 7. 2025.

CESNET, z.s.p.o. Logo