CVE-2025-9182CWE-400denial-of-service

CVE-2025-9182

High · published August 20, 2025

CVSS v3.1

7.5

EPSS

Percentile

34.3

In the wild

Unconfirmed

What it is

Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00411 · 34.3th percentile
Weakness: CWE-400 · Uncontrolled Resource Consumption
Published: 2025-08-20T01:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 140.2.0	140.2.0
mozilla/firefox	< 142.0	142.0
mozilla/thunderbird	< 140.2.0	140.2.0
mozilla/thunderbird	< 142.0	142.0

References (5)

https://bugzilla.mozilla.org/show_bug.cgi?id=1975837 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-64/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-67/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-70/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-72/ · [email protected]

EPSS history

Timeline

19 AUG 20:33Z
Denial-of-service due to out-of-memory in the Graphics: WebRender component
cvelistv5