PatchGap
Firefox · Core

CVE-2025-5272

Memory Corruption in Core
Medium CVSS 7.3 firefox Memory Corruption

Overview

Medium
Severity
7.3
CVSS
No
Exploited ITW
Embargoed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentCore
Bug ClassMemory Corruption
Tracker1726254
CWECWE-787 (Out-of-bounds write)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA KEVNot listed
Creditedthe Mozilla Fuzzing Team, Andrew Osmond
Disclosed2025-05-27

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.
On This Page