CVE-2025-4082CWE-125

CVE-2025-4082

Medium · published April 29, 2025

CVSS v3.1
5.9
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges.

*This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-04-29T18:15Z
Affected products (5)
ProductVersionsFixed in
mozilla/firefox< 115.23115.23
mozilla/firefox< 138.0138.0
mozilla/firefox≥ 128.0, < 128.10128.10
mozilla/thunderbird< 128.10.0128.10.0
mozilla/thunderbird< 138.0138.0
References (7)
https://bugzilla.mozilla.org/show_bug.cgi?id=1937097 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-28/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-29/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-30/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-31/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-32/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/05/msg00022.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 29 APR 13:13Z
    WebGL shader attribute memory corruption in Thunderbird for macOS
    cvelistv5