CVE-2025-4918: Mozilla Firefox Buffer Overflow Vulnerability

CVE-2025-4918 Overview

CVE-2025-4918 is an out-of-bounds read or write vulnerability affecting the JavaScript Promise object implementation in Mozilla Firefox and Thunderbird. An attacker can trigger memory access beyond allocated bounds when manipulating Promise objects, leading to memory corruption. The flaw is classified under [CWE-125] (Out-of-bounds Read) and reaches the highest impact tier on confidentiality, integrity, and availability. Mozilla addressed the issue in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2. Because the attack vector is network-based and requires no privileges or user interaction beyond visiting a malicious page, the vulnerability is well suited to drive-by browser exploitation.

Critical Impact
Successful exploitation enables arbitrary memory access in the browser process, opening the path to remote code execution within the content sandbox and full compromise of confidentiality, integrity, and availability.

Affected Products

Mozilla Firefox versions prior to 138.0.4
Mozilla Firefox ESR prior to 128.10.1 and 115.23.1
Mozilla Thunderbird prior to 128.10.2 and 138.0.2

Discovery Timeline

2025-05-17 - CVE-2025-4918 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-4918

Vulnerability Analysis

The vulnerability resides in the handling of JavaScript Promise objects within the SpiderMonkey engine used by Firefox and Thunderbird. An attacker controlling JavaScript execution can craft Promise operations that read or write memory outside the bounds of the object's allocated storage. Out-of-bounds access in a JIT-compiled engine typically allows the attacker to leak adjacent heap data or corrupt object metadata. Once metadata is corrupted, attackers can pivot toward type confusion and arbitrary read/write primitives, which form the basis for sandboxed code execution. The vulnerability is exploitable through any rendering path that processes attacker-supplied JavaScript, including web pages and HTML email content rendered by Thunderbird.

Root Cause

The root cause is missing bounds validation on a memory access path associated with Promise object internals. Mozilla's advisory family MFSA-2025-36 through MFSA-2025-41 confirms the underlying defect was a memory safety bug in the JavaScript engine. The condition triggers when specially constructed Promise operations cause the engine to compute an incorrect offset or length, bypassing the safety assumptions enforced elsewhere in SpiderMonkey.

Attack Vector

The attack vector is network-based. A remote attacker hosts a malicious web page containing crafted JavaScript that exercises the vulnerable Promise code path. Victims trigger exploitation by visiting the page in an unpatched Firefox build, or by viewing a malicious HTML email message in Thunderbird with remote content enabled. No authentication or user interaction beyond normal browsing is required. Public technical analysis is available through the Mozilla Bug Report #1966612 and the Vicarius CVE-2025-4918 Detection Analysis.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in prose only; refer to the Mozilla advisories for technical patch details.

Detection Methods for CVE-2025-4918

Indicators of Compromise

Firefox or Thunderbird processes spawning unexpected child processes such as command shells or scripting interpreters
Renderer process crashes referencing js::Promise or SpiderMonkey heap corruption in crash telemetry
Outbound connections from browser processes to unfamiliar domains immediately after JavaScript execution
Presence of Firefox versions prior to 138.0.4 or ESR builds prior to 128.10.1 / 115.23.1 in asset inventory

Detection Strategies

Inventory endpoints and identify Firefox and Thunderbird builds older than the fixed versions across the environment
Hunt for anomalous process lineage where firefox.exe or thunderbird.exe is the parent of native binaries outside the browser sandbox
Correlate browser crash logs with network telemetry to surface exploitation attempts that fail before achieving persistence

Monitoring Recommendations

Forward browser crash reports and EDR telemetry to a central data lake for retroactive hunting against this CVE
Monitor egress traffic from user workstations for connections to newly registered or low-reputation domains following web browsing sessions
Alert on Thunderbird rendering remote HTML content, which broadens the attack surface for this class of bug

How to Mitigate CVE-2025-4918

Immediate Actions Required

Upgrade Firefox to 138.0.4 or later and Firefox ESR to 128.10.1 or 115.23.1 across all managed endpoints
Upgrade Thunderbird to 128.10.2 or 138.0.2 or later on every workstation that processes email
Apply the Debian security updates documented in the Debian LTS Announcement May 2025-24 and the Debian LTS Announcement May 2025-46 on affected Linux fleets
Validate patch deployment by querying installed browser versions through endpoint management tooling

Patch Information

Mozilla released fixed builds in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2. Patch metadata and affected components are documented in Mozilla Security Advisory MFSA-2025-36, MFSA-2025-37, MFSA-2025-38, MFSA-2025-40, and MFSA-2025-41.

Workarounds

Disable JavaScript in Firefox by setting javascript.enabled to false in about:config where business workflows allow
Configure Thunderbird to block remote content in messages and disable JavaScript in mail rendering to reduce email-borne exploitation risk
Enforce browser allow-listing or restrict high-risk users to non-vulnerable browser builds until patching completes
Review additional vendor guidance in the Vicarius CVE-2025-4918 Mitigation Guide

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Debian/Ubuntu patch deployment
sudo apt-get update && sudo apt-get install --only-upgrade firefox-esr thunderbird