CVE-2025-9184
Published: 19 August 2025
Summary
CVE-2025-9184 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-9184 encompasses multiple memory safety bugs affecting Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. These bugs include instances showing evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and NVD-CWE-noinfo, with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network, though it demands high attack complexity. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially enabling arbitrary code execution within the affected browser or email client processes.
Mozilla's security advisories (MFSA 2025-64, 67, 70, and 72) detail the fixes applied in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird ESR 140.2. Security practitioners should prioritize updating to these patched versions and monitor the linked Bugzilla entries for additional technical details on the individual bugs (1929482, 1976376, 1979163, 1979955).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25238
Vulnerability details
Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
more
run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption bugs enabling remote arbitrary code execution in client software (browser/email) directly map to exploitation for client execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of software flaws like the memory safety bugs in CVE-2025-9184 through vendor patches.
Implements runtime memory protections such as ASLR and DEP to directly mitigate exploitation of memory corruption vulnerabilities in CVE-2025-9184.
Ensures organizations receive and act on vendor security advisories like Mozilla's MFSA for CVE-2025-9184 to enable rapid flaw remediation.