CVE-2025-10532

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1979502Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-73/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-75/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-77/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-78/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html
https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html

Timeline

Published: Sep 16, 2025
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-105338.8Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, CVE-2025-105348.1Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.CVE-2025-105357.5Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.CVE-2025-105366.2Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, CVE-2025-105378.8Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence CVE-2025-105388.8An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor t CVE-2025-105394.8Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves i CVE-2025-10546.4The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Coun CVE-2025-105406.5iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management s CVE-2025-105417.8iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an inse CVE-2025-105429.8iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. CVE-2025-105435.3In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly