CVE-2025-8040CWE-119

CVE-2025-8040

High · published July 23, 2025

CVSS v3.1

8.8

EPSS

Percentile

26.5

In the wild

Unconfirmed

What it is

Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00343 · 26.5th percentile
Weakness: CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published: 2025-07-23T01:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 140.1	140.1
mozilla/firefox	< 141.0	141.0
mozilla/thunderbird	< 140.1	140.1
mozilla/thunderbird	< 141.0	141.0

References (5)

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975058%2C1975998 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-56/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-59/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-61/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-63/ · [email protected]

EPSS history

Timeline

22 JUL 20:49Z
Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
cvelistv5