CVE-2025-1942 Disclosure of uninitialized memory when .toUpperCase() causes string to get longer

Critical 9.8 Published 4 Mar 2025 Updated 4 Jun 2026

Attackers can read uninitialized memory when string case conversion increases length, potentially exposing sensitive data in Firefox and Thunderbird.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-1942?

CVE-2025-1942 is a critical vulnerability in Mozilla Firefox, published on 4 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.

Weakness: CWE-908

Which versions are affected by CVE-2025-1942?

It affects 2 products.

Products include Mozilla Firefox, Mozilla Thunderbird.

How do I fix CVE-2025-1942?

Upgrade to a fixed version.

Is CVE-2025-1942 being exploited?

There is no known exploitation of CVE-2025-1942 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-r83v-rmq7-r5m4, UBUNTU-CVE-2025-1942.