CVE-2025-0242

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169Broken Link, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2025-01/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-02/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-03/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-04/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-05/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0236Out-of-bounds vulnerability in slope processing during curve…5.3
• CVE-2025-0237The WebChannel API, which is used to transport various infor…5.4
• CVE-2025-0238Assuming a controlled failed memory allocation, an attacker …5.3
• CVE-2025-0239When using Alt-Svc, ALPN did not properly validate certifica…4
• CVE-2025-0240Parsing a JavaScript module as JSON could, under some circum…4
• CVE-2025-0241When segmenting specially crafted text, segmentation would c…7.7
• CVE-2025-0243Memory safety bugs present in Firefox 133, Thunderbird 133, …5.1
• CVE-2025-0244When redirecting to an invalid protocol scheme, an attacker …5.3
• CVE-2025-0245Under certain circumstances, a user opt-in setting that Focu…3.3
• CVE-2025-0246When using an invalid protocol scheme, an attacker could spo…6.5
• CVE-2025-0247Memory safety bugs present in Firefox 133 and Thunderbird 13…9.8
• CVE-2025-0248HCL iNotes is susceptible to a Reflected Cross-site Scriptin…8.1