CVE-2025-4082

MediumCVSS 5.9/10Last modified Oct 5, 2026

Description

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-408207.5Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This CVE-2025-408277.8A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). T CVE-2025-408297.8A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vu CVE-2025-40839.1A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in CVE-2025-408306.7A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper author CVE-2025-408316.5A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of d CVE-2025-408337.5The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an CVE-2025-408345.7A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the i CVE-2025-408369.8Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute command CVE-2025-408378.8Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with CVE-2025-408387.5Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead t CVE-2025-40845.7Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command