CVE-2025-9187 covers memory safety bugs in Firefox 141 and Thunderbird 141. The record scores it 9.8 Critical, while Mozilla rates it High. Both vendors agree on the fix: update to Firefox 142 or Thunderbird 142, or later. Mozilla says some of the bugs showed memory corruption and could probably be turned into code execution.
What's affected
Per the record and Mozilla's advisories, the affected releases are Firefox 141 and Thunderbird 141. Mozilla fixed them in Firefox 142 and Thunderbird 142. The Firefox advisory (MFSA 2025-64) lists no ESR versions for this CVE. It does list ESR updates for separate memory safety issues, CVE-2025-9184 and CVE-2025-9185, which are not the subject of this post.
Severity differs between sources, so here are both. The record gives CVSS 3.1 base score 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which is why it is called Critical. Mozilla's own impact rating for the advisory is High. Mozilla's wording is cautious: some of the bugs showed evidence of memory corruption, and it presumes that with enough effort some could have been exploited to run arbitrary code. It does not say any were exploited.
The linked bug list covers four Bugzilla entries (1825621, 1970079, 1976736 and 1979072), so this one identifier groups several separate memory safety fixes.
How to check if you're exposed
- In Firefox, open the menu, choose Help, then About Firefox. The version shows there and the browser starts an update check. Anything below 142 on the release channel is affected if it is exactly the 141 line.
- In Thunderbird, use Help, then About Thunderbird, and look for 141.
- On managed machines, query your software inventory for Firefox and Thunderbird versions. On Linux you can also run
firefox --versionandthunderbird --versionin a shell. - Check portable and per-user installs, kiosks and lab images. They often sit outside normal patch tooling.
If you ship software that bundles Firefox or Thunderbird components, check the version you embed and the vendor's release notes.
What to do now
- Update Firefox to 142 or later and Thunderbird to 142 or later. Restart the application, since an update does not protect an already running process.
- Confirm automatic updates are on and not blocked by policy. If you pin versions, move the pin.
- For Linux distribution packages, apply your distribution's security update and check the changelog for these CVE ids, because package versions can differ from upstream numbers.
- If you cannot update straight away, reduce exposure. Avoid untrusted sites and untrusted email content on the affected machines until the update lands.
- Record the fixed versions in your asset inventory so the next audit has an answer.
Why it matters
The weakness class is CWE-119 (improper restriction of operations within the bounds of a memory buffer). Browsers and mail clients parse a huge amount of untrusted content, such as web pages, images, fonts and messages. A memory safety flaw in that code can corrupt memory, and a skilled attacker can sometimes turn corruption into code execution.
This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog according to the record, and the Mozilla advisory does not say it was used in attacks. The practical risk is a lag between a fix shipping and a laptop updating. A fleet with a few stragglers on 141 is the realistic exposure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2025-9187?
Firefox 142 and Thunderbird 142, per Mozilla. Anything newer on the same release channel also contains the fix.
Is it Critical or High?
Both appear. The record scores it 9.8 Critical on CVSS 3.1. Mozilla rates the advisory High. Patch on the stricter reading.
Is it exploited in the wild?
Neither the record nor the Mozilla advisories we read say so. It is not flagged as a CISA Known Exploited Vulnerability in the record.
Sources
Last reviewed: 18 October 2026.
