CVE-2025-9187

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2025
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-91887.8There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. CVE-2025-91897.8There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB fi CVE-2025-91904.8The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute CVE-2025-91916.3The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untr CVE-2025-91933.5A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executi CVE-2025-91944.3The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() func CVE-2025-91954.4Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service CVE-2025-91965.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information CVE-2025-91986.5The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and CVE-2025-91996.5The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slide CVE-2025-92007.5The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the CVE-2025-92017.8A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local use