CVE-2025-4082

Description

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.* This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

Reserved 2025-04-29 | Published 2025-04-29 | Updated 2025-05-02 | Assigner mozilla

Problem types

WebGL shader attribute memory corruption in Thunderbird for macOS

Product status

Any version before 138
affected

Any version before 128.10
affected

Any version before 115.23
affected

Any version before 138
affected

Any version before 128.10
affected

Credits

un3xploitable & GF

References

bugzilla.mozilla.org/show_bug.cgi?id=1937097

www.mozilla.org/security/advisories/mfsa2025-28/

www.mozilla.org/security/advisories/mfsa2025-29/

www.mozilla.org/security/advisories/mfsa2025-30/

www.mozilla.org/security/advisories/mfsa2025-31/

www.mozilla.org/security/advisories/mfsa2025-32/

cve.org (CVE-2025-4082)

nvd.nist.gov (CVE-2025-4082)

Download JSON