CVE-2025-4918

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125CWE-787

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2025
Last modified
Sep 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-491807.8A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to aCVE-2025-491818.6Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker CVE-2025-491829.8Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get fCVE-2025-491837.5All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. ThiCVE-2025-491847.5A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings oCVE-2025-491855.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JaCVE-2025-491866.5The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it sCVE-2025-491875.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwoCVE-2025-491887.5The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.CVE-2025-491896.1The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, sCVE-2025-49198.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability wasCVE-2025-491905.8The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports
CVE-2025-4918: Critical severity, CVSS 9.8 | Vulnix