Search for vulnerabilities
Vulnerability details: VCID-qst2-ktgg-jkfp
Vulnerability ID VCID-qst2-ktgg-jkfp
Aliases CVE-2025-8034
Summary Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8034.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-8034
cvssv3.1 8.8 https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-56
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-57
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-58
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-59
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-61
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-62
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-63
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-56/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-56/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-56/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-57/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-57/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-57/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-58/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-58/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-58/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-59/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-59/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-59/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-61/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-61/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-61/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-62/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-62/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-62/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2025-63/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-63/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-63/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8034.json
https://api.first.org/data/v1/epss?cve=CVE-2025-8034
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2382711 https://bugzilla.redhat.com/show_bug.cgi?id=2382711
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
CVE-2025-8034 https://nvd.nist.gov/vuln/detail/CVE-2025-8034
mfsa2025-56 https://www.mozilla.org/en-US/security/advisories/mfsa2025-56
mfsa2025-56 https://www.mozilla.org/security/advisories/mfsa2025-56/
mfsa2025-57 https://www.mozilla.org/en-US/security/advisories/mfsa2025-57
mfsa2025-57 https://www.mozilla.org/security/advisories/mfsa2025-57/
mfsa2025-58 https://www.mozilla.org/en-US/security/advisories/mfsa2025-58
mfsa2025-58 https://www.mozilla.org/security/advisories/mfsa2025-58/
mfsa2025-59 https://www.mozilla.org/en-US/security/advisories/mfsa2025-59
mfsa2025-59 https://www.mozilla.org/security/advisories/mfsa2025-59/
mfsa2025-61 https://www.mozilla.org/en-US/security/advisories/mfsa2025-61
mfsa2025-61 https://www.mozilla.org/security/advisories/mfsa2025-61/
mfsa2025-62 https://www.mozilla.org/en-US/security/advisories/mfsa2025-62
mfsa2025-62 https://www.mozilla.org/security/advisories/mfsa2025-62/
mfsa2025-63 https://www.mozilla.org/en-US/security/advisories/mfsa2025-63
mfsa2025-63 https://www.mozilla.org/security/advisories/mfsa2025-63/
RHSA-2025:11747 https://access.redhat.com/errata/RHSA-2025:11747
RHSA-2025:11748 https://access.redhat.com/errata/RHSA-2025:11748
RHSA-2025:11797 https://access.redhat.com/errata/RHSA-2025:11797
RHSA-2025:12044 https://access.redhat.com/errata/RHSA-2025:12044
RHSA-2025:12045 https://access.redhat.com/errata/RHSA-2025:12045
RHSA-2025:12046 https://access.redhat.com/errata/RHSA-2025:12046
RHSA-2025:12187 https://access.redhat.com/errata/RHSA-2025:12187
RHSA-2025:12188 https://access.redhat.com/errata/RHSA-2025:12188
RHSA-2025:12278 https://access.redhat.com/errata/RHSA-2025:12278
RHSA-2025:12302 https://access.redhat.com/errata/RHSA-2025:12302
RHSA-2025:12353 https://access.redhat.com/errata/RHSA-2025:12353
RHSA-2025:12360 https://access.redhat.com/errata/RHSA-2025:12360
RHSA-2025:12361 https://access.redhat.com/errata/RHSA-2025:12361
RHSA-2025:13645 https://access.redhat.com/errata/RHSA-2025:13645
RHSA-2025:13646 https://access.redhat.com/errata/RHSA-2025:13646
RHSA-2025:13647 https://access.redhat.com/errata/RHSA-2025:13647
RHSA-2025:13648 https://access.redhat.com/errata/RHSA-2025:13648
RHSA-2025:13649 https://access.redhat.com/errata/RHSA-2025:13649
RHSA-2025:13650 https://access.redhat.com/errata/RHSA-2025:13650
RHSA-2025:13651 https://access.redhat.com/errata/RHSA-2025:13651
RHSA-2025:13676 https://access.redhat.com/errata/RHSA-2025:13676
show_bug.cgi?id=1970422 https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8034.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1970422
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-56/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-56/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-56/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-57/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-57/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-57/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-58/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-58/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-58/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-59/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-59/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-59/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-61/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-61/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-61/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-62/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-62/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-62/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-63/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:27:39Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-63/
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-07-24T03:55:30Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-63/
Exploit Prediction Scoring System (EPSS)
Percentile 0.12757
EPSS Score 0.00044
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:24.248527+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2025/mfsa2025-62.yml 37.0.0