An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1966612 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-36/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-37/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-38/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-40/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-41/ | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html | |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html | |
| https://www.vicarius.io/vsociety/posts/cve-2025-4918-detect-firefox-out-of-bounds-write | Exploit Third Party Advisory |
| https://www.vicarius.io/vsociety/posts/cve-2025-4918-mitigate-firefox-out-of-bounds-write | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Sep 2026, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) Un atacante logró realizar una lectura o escritura fuera de los límites en un objeto “Promise” de JavaScript. Esta vulnerabilidad afecta a Firefox (versión anterior a 138.0.4), Firefox ESR (versión anterior a 128.10.1) y Firefox ESR (versión anterior a 115.23.1). |
Information
Published : 2025-05-17 22:15
Updated : 2026-09-30 18:10
NVD link : CVE-2025-4918
Mitre link : CVE-2025-4918
CVE.ORG link : CVE-2025-4918
JSON object : View
Products Affected
mozilla
- firefox
- thunderbird