CVE-2025-8027

Description

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

Reserved 2025-07-22 | Published 2025-07-22 | Updated 2025-07-22 | Assigner mozilla

Problem types

JavaScript engine only wrote partial return value to stack

Product status

Any version before 141
affected

Any version before 115.26
affected

Any version before 128.13
affected

Any version before 140.1
affected

Any version before 141
affected

Any version before 128.13
affected

Any version before 140.1
affected

Credits

Nan Wang

References

bugzilla.mozilla.org/show_bug.cgi?id=1968423

www.mozilla.org/security/advisories/mfsa2025-56/

www.mozilla.org/security/advisories/mfsa2025-57/

www.mozilla.org/security/advisories/mfsa2025-58/

www.mozilla.org/security/advisories/mfsa2025-59/

www.mozilla.org/security/advisories/mfsa2025-61/

www.mozilla.org/security/advisories/mfsa2025-62/

www.mozilla.org/security/advisories/mfsa2025-63/

cve.org (CVE-2025-8027)

nvd.nist.gov (CVE-2025-8027)

Download JSON