CVE-2025-4082 — Out-of-bounds Read in Mozilla Firefox

CWE-125 — Out-of-bounds Read11 documents7 sources
Severity
5.9MEDIUMNVD
EPSS
0.3%
top 43.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Thunderbird
Timeline
PublishedApr 29

Description

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶NVDmozilla/thunderbird< 128.10.0+1
▶NVDmozilla/firefox128.0 — 128.10+2

🔴Vulnerability Details

3
OSV
CVE-2025-4082: Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to↗2025-04-29
▶
CVEList
WebGL shader attribute memory corruption in Thunderbird for macOS↗2025-04-29
▶
GHSA
GHSA-xhhw-j3h4-3x9r: Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to↗2025-04-29
▶

📋Vendor Advisories

7
Red Hat
firefox: thunderbird: WebGL shader attribute memory corruption in Firefox for macOS↗2025-04-29
▶
Debian
CVE-2025-4082: firefox - Modification of specific WebGL shader attributes could trigger an out-of-bounds ...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-28: CVE-2025-4082↗
▶
Mozilla
Mozilla Foundation Security Advisory 2025-32: CVE-2025-4082↗
▶
Mozilla
Mozilla Foundation Security Advisory 2025-30: CVE-2025-4082↗
▶
CVE-2025-4082 — Out-of-bounds Read in Mozilla Firefox | cvebase