CVE-2025-4093

Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.10 and Thunderbird 128.10.

• CWE-119

• https://bugzilla.mozilla.org/show_bug.cgi?id=1894100Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-32/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html

Published

Apr 29, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40924Catalyst::Plugin::Session before version 0.44 for Perl gener…6.5
• CVE-2025-40925Starch versions 0.14 and earlier generate session ids insecu…9.1
• CVE-2025-40926Plack::Middleware::Session::Simple versions before 0.05 for …9.8
• CVE-2025-40927CGI::Simple versions before 1.282 for Perl has a HTTP respon…7.3
• CVE-2025-40928JSON::XS before version 4.04 for Perl has an integer buffer …7.5
• CVE-2025-40929Cpanel::JSON::XS before version 4.40 for Perl has an integer…5.6
• CVE-2025-40930JSON::SIMD before version 1.07 and earlier for Perl has an i…7.5
• CVE-2025-40931Apache::Session::Generate::MD5 versions through 1.94 for Per…9.1
• CVE-2025-40932Apache::SessionX versions through 2.01 for Perl create insec…8.2
• CVE-2025-40933Apache::AuthAny::Cookie v0.201 or earlier for Perl generates…7.5
• CVE-2025-40934XML-Sig versions 0.27 through 0.67 for Perl incorrectly vali…9.3
• CVE-2025-40935A vulnerability has been identified in RUGGEDCOM RMC8388 V5.…5.3