CVE-2025-9179
Published: 19 August 2025
Summary
CVE-2025-9179 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 38.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely flaw remediation through patching, directly addressing the memory corruption vulnerability fixed in updated Firefox and Thunderbird versions.
SI-16 provides memory protection mechanisms like ASLR and DEP to prevent exploitation of memory corruption (CWE-119) in the GMP process.
SC-39 enforces process isolation via the GMP sandbox, limiting the scope of compromise despite differing privileges from the content process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in sandboxed browser GMP process directly enables client-side exploitation for code execution (T1203).
NVD Description
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR…
more
115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
Deeper analysisAI
CVE-2025-9179 is a memory corruption vulnerability (CWE-119) in the GMP process, which handles encrypted media in Mozilla Firefox and Thunderbird. This process is heavily sandboxed but maintains slightly different privileges compared to the content process. The issue affects Firefox and Thunderbird versions prior to Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
A remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Exploitation enables memory corruption within the sandboxed GMP process, potentially compromising confidentiality, integrity, and availability to a high degree due to the privilege differences from the content process.
Mozilla security advisories MFSA2025-64, MFSA2025-65, MFSA2025-66, and MFSA2025-67, along with Bugzilla entry 1979527, detail the patches applied in the listed fixed versions of Firefox and Thunderbird to mitigate the vulnerability.
Details
- CWE(s)