CVE-2025-1938

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-19393.9Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to tri CVE-2025-19407.1A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in CVE-2025-19419.1Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct CVE-2025-19429.8When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. CVE-2025-19438.2Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2025-19446.5picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTo CVE-2025-19459.8picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. CVE-2025-19469.8A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the functi CVE-2025-19479.8A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of th CVE-2025-19487.5In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETT CVE-2025-19496.1A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /CVE-2025-19507.8IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to im