CVE-2025-9187 Memory safety bugs fixed in Firefox 142 and Thunderbird 142
Memory safety bugs in Firefox and Thunderbird allow arbitrary code execution, requiring users to upgrade to version 142.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9187?
CVE-2025-9187 is a critical memory corruption vulnerability in Mozilla Firefox, published on 19 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142.
Weakness: CWE-119
Which versions are affected by CVE-2025-9187?
It affects 2 products.
Linux distribution packages (24)
mozilla-nss SUSE:Enterprise Storage 7.1 | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.1 | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.2 | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.3 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.4 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Micro 5.5 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.112.2-58.133.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.112.2-58.133.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 3.112.2-150000.3.132.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Manager Proxy LTS 4.3 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss SUSE:Manager Server LTS 4.3 | All versions | 3.112.2-150400.3.60.1 |
mozilla-nss openSUSE:Leap 15.6 | All versions | 3.112.2-150400.3.60.1 |
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2025-9187?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9187 being exploited?
There is no known exploitation of CVE-2025-9187 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-6rqq-g95r-qrcc, SUSE-SU-2025:3759-1, SUSE-SU-2025:3760-1, SUSE-SU-2025:3804-1, UBUNTU-CVE-2025-9187.