PT-2025-18151 · Mozilla+2 · Thunderbird+5

Un3Xploitable · Published 2025-04-29 · Updated 2025-10-31 · CVE-2025-4082

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Firefox ESR versions prior to 128.10 Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10

Description Modification of specific WebGL shader attributes could trigger an out-of-bounds read. When chained with other vulnerabilities, this issue could be used to escalate privileges. This bug only affects Firefox for macOS, with other versions of Firefox being unaffected.

Recommendations For Firefox versions prior to 138, update to version 138 or later. For Firefox ESR versions prior to 128.10, update to version 128.10 or later. For Firefox ESR versions prior to 115.23, update to version 115.23 or later. For Thunderbird versions prior to 138, update to version 138 or later. For Thunderbird ESR versions prior to 128.10, update to version 128.10 or later.

Fix

RCE

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2025-6254

ALT-PU-2025-6353

ALT-PU-2025-6478

ALT-PU-2025-7022

ALT-PU-2025-7695

ALT-PU-2025-7697

BDU:2025-10508

CVE-2025-4082

DLA-4167-1

OESA-2025-2557

OPENSUSE-SU-2025:15042-1

OPENSUSE-SU-2025:15045-1

OPENSUSE-SU-2025_1436-1

OPENSUSE-SU-2025_1506-1

SUSE-SU-2025:1436-1

SUSE-SU-2025:1506-1

Affected Products

Alt Linux

Firefox

Firefox Esr

Suse

Thunderbird

Thunderbird Esr

References · 66

• https://nvd.nist.gov/vuln/detail/CVE-2025-10533 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15042-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-32/#CVE-2025-4082 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4082 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-28 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-32 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-28/#CVE-2025-4082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4084 · Security Note
• https://mozilla.org/security/advisories/mfsa2025-30 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11709 · Security Note
• https://ubuntu.com/security/CVE-2025-4082 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10527 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10536 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-10537 · Security Note