CVE-2025-4090

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1929478Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-28/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-31/Vendor Advisory

Timeline

Published: Apr 29, 2025
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-409004.6An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An CVE-2025-409014.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input paramet CVE-2025-409024.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authent CVE-2025-409034.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input pa CVE-2025-409045.4A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An CVE-2025-409057.3WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for CVE-2025-409069.8BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14 CVE-2025-409075.3FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI libra CVE-2025-409089.1YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified CVE-2025-409095.9Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at th CVE-2025-40918.1Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of CVE-2025-409106.5Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attacker