thunderbird: firefox: Uninitialized memory in the JavaScript Engine component

cve CVE-2025-9181 2 sources, 2 claims · Watch

Red Hat writes:
thunderbird: firefox: Uninitialized memory in the JavaScript Engine component the claim

Severity: MEDIUM NVD
moderate Red Hat
CVSS they disagree: 6.5 NVD
6.1 Red Hat
Vendor: Mozilla NVD
Product: Firefox NVD
CWE: CWE-457 NVD
CWE-665 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	network N	network N
Attack complexity AC	low L	low L
Privileges required PR	none N	none N
User interaction UI	required R	required R
Scope S	unchanged U	changed C
Confidentiality C	high H	low L
Integrity I	none N	low L
Availability A	none N	none N

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2025-08-19	first spoke of it: Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.	NVD
2025-08-19	first spoke of it: thunderbird: firefox: Uninitialized memory in the JavaScript Engine component	Red Hat

What it is to other things

affects	mozilla/firefox NVD
affects	mozilla/thunderbird NVD
made_by	mozilla NVD

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	no
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

NVD

6.5

receipt

Source: NVD
Its words: 6.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

Red Hat

6.1

receipt

Source: Red Hat
Its words: 6.1
Read by: field:cvss3_score
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2025-9181",
  "CWE": "CWE-665",
  "advisories": [
    "RHSA-2025:15423",
    "RHSA-2025:15434",
    "RHSA-2025:15424",
    "RHSA-2025:15435",
    "RHSA-2025:14743",
    "RHSA-2025:15535",
    "RHSA-2025:15436",
    "RHSA-2025:15437",
    "RHSA-2025:14844",
    "RHSA-2025:15438",
    "RHSA-2025:14416",
    "RHSA-2025:14417",
    "RHSA-2025:15418",
    "RHSA-2025:15419",
    "RHSA-2025:15430",
    "RHSA-2025:15496",
    "RHSA-2025:15420",
    "RHSA-2025:14442",
    "RHSA-2025:14640",
    "RHSA-2025:15421",
    "RHSA-2025:15422"
  ],
  "affected_packages": [
    "firefox-0:128.14.0-2.el8_10",
    "thunderbird-0:128.14.0-3.el8_10",
    "firefox-0:128.14.0-2.el9_6",
    "firefox-0:128.14.0-2.el8_6",
    "firefox-0:128.14.0-2.el7_9",
    "firefox-0:128.14.0-2.el8_8",
    "thunderbird-0:128.14.0-3.el9_6",
    "thunderbird-0:128.14.0-3.el8_8",
    "firefox-0:128.14.0-2.el9_0",
    "thunderbird-0:128.14.0-3.el9_4",
    "thunderbird-0:128.14.0-3.el8_6",
    "firefox-0:128.14.0-2.el9_2",
    "thunderbird-0:128.14.0-3.el9_2",
    "firefox-0:128.14.0-2.el10_0",
    "thunderbird-0:128.14.0-3.el10_0",
    "firefox-0:128.14.0-2.el8_2",
    "thunderbird-0:128.14.0-3.el8_4",
    "thunderbird-0:128.14.0-3.el9_0",
    "firefox-0:128.14.0-2.el9_4",
    "thunderbird-0:128.14.0-3.el8_2",
    "firefox-0:128.14.0-2.el8_4"
  ],
  "bugzilla": "2389583",
  "bugzilla_description": "thunderbird: firefox: Uninitialized memory in the JavaScript Engine component",
  "cvss3_score": "6.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-08-19T20:33:55Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-9181.json",
  "severity": "moderate"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2026-09-29 09:44 UTC	—

What the source handed over

{
  "CVE": "CVE-2025-9181",
  "CWE": "CWE-665",
  "advisories": [
    "RHSA-2025:15423",
    "RHSA-2025:15434",
    "RHSA-2025:15424",
    "RHSA-2025:15435",
    "RHSA-2025:14743",
    "RHSA-2025:15535",
    "RHSA-2025:15436",
    "RHSA-2025:15437",
    "RHSA-2025:14844",
    "RHSA-2025:15438",
    "RHSA-2025:14416",
    "RHSA-2025:14417",
    "RHSA-2025:15418",
    "RHSA-2025:15419",
    "RHSA-2025:15430",
    "RHSA-2025:15496",
    "RHSA-2025:15420",
    "RHSA-2025:14442",
    "RHSA-2025:14640",
    "RHSA-2025:15421",
    "RHSA-2025:15422"
  ],
  "affected_packages": [
    "firefox-0:128.14.0-2.el8_10",
    "thunderbird-0:128.14.0-3.el8_10",
    "firefox-0:128.14.0-2.el9_6",
    "firefox-0:128.14.0-2.el8_6",
    "firefox-0:128.14.0-2.el7_9",
    "firefox-0:128.14.0-2.el8_8",
    "thunderbird-0:128.14.0-3.el9_6",
    "thunderbird-0:128.14.0-3.el8_8",
    "firefox-0:128.14.0-2.el9_0",
    "thunderbird-0:128.14.0-3.el9_4",
    "thunderbird-0:128.14.0-3.el8_6",
    "firefox-0:128.14.0-2.el9_2",
    "thunderbird-0:128.14.0-3.el9_2",
    "firefox-0:128.14.0-2.el10_0",
    "thunderbird-0:128.14.0-3.el10_0",
    "firefox-0:128.14.0-2.el8_2",
    "thunderbird-0:128.14.0-3.el8_4",
    "thunderbird-0:128.14.0-3.el9_0",
    "firefox-0:128.14.0-2.el9_4",
    "thunderbird-0:128.14.0-3.el8_2",
    "firefox-0:128.14.0-2.el8_4"
  ],
  "bugzilla": "2389583",
  "bugzilla_description": "thunderbird: firefox: Uninitialized memory in the JavaScript Engine component",
  "cvss3_score": "6.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-08-19T20:33:55Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-9181.json",
  "severity": "moderate"
}

—

CWE

cwe

different words

NVD

CWE-457

receipt

Source: NVD
Its words: CWE-457
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	CWE-457
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

different words

Red Hat

CWE-665

receipt

Source: Red Hat
Its words: CWE-665
Read by: field:CWE
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2025-9181",
  "CWE": "CWE-665",
  "advisories": [
    "RHSA-2025:15423",
    "RHSA-2025:15434",
    "RHSA-2025:15424",
    "RHSA-2025:15435",
    "RHSA-2025:14743",
    "RHSA-2025:15535",
    "RHSA-2025:15436",
    "RHSA-2025:15437",
    "RHSA-2025:14844",
    "RHSA-2025:15438",
    "RHSA-2025:14416",
    "RHSA-2025:14417",
    "RHSA-2025:15418",
    "RHSA-2025:15419",
    "RHSA-2025:15430",
    "RHSA-2025:15496",
    "RHSA-2025:15420",
    "RHSA-2025:14442",
    "RHSA-2025:14640",
    "RHSA-2025:15421",
    "RHSA-2025:15422"
  ],
  "affected_packages": [
    "firefox-0:128.14.0-2.el8_10",
    "thunderbird-0:128.14.0-3.el8_10",
    "firefox-0:128.14.0-2.el9_6",
    "firefox-0:128.14.0-2.el8_6",
    "firefox-0:128.14.0-2.el7_9",
    "firefox-0:128.14.0-2.el8_8",
    "thunderbird-0:128.14.0-3.el9_6",
    "thunderbird-0:128.14.0-3.el8_8",
    "firefox-0:128.14.0-2.el9_0",
    "thunderbird-0:128.14.0-3.el9_4",
    "thunderbird-0:128.14.0-3.el8_6",
    "firefox-0:128.14.0-2.el9_2",
    "thunderbird-0:128.14.0-3.el9_2",
    "firefox-0:128.14.0-2.el10_0",
    "thunderbird-0:128.14.0-3.el10_0",
    "firefox-0:128.14.0-2.el8_2",
    "thunderbird-0:128.14.0-3.el8_4",
    "thunderbird-0:128.14.0-3.el9_0",
    "firefox-0:128.14.0-2.el9_4",
    "thunderbird-0:128.14.0-3.el8_2",
    "firefox-0:128.14.0-2.el8_4"
  ],
  "bugzilla": "2389583",
  "bugzilla_description": "thunderbird: firefox: Uninitialized memory in the JavaScript Engine component",
  "cvss3_score": "6.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-08-19T20:33:55Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-9181.json",
  "severity": "moderate"
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	none
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Packages

packages

Red Hat

firefox-0:128.14.0-2.el8_10, thunderbird-0:128.14.0-3.el8_10, firefox-0:128.14.0-2.el9_6, firefox-0:128.14.0-2.el8_6, firefox-0:128.14.0-2.el7_9, firefox-0:128.14.0-2.el8_8, thunderbird-0:128.14.0-3.el9_6, thunderbird-0:128.14.0-3.el8_8, firefox-0:128.14.0-2.el9_0, thunderbird-0:128.14.0-3.el9_4, thunderbird-0:128.14.0-3.el8_6, firefox-0:128.14.0-2.el9_2, thunderbird-0:128.14.0-3.el9_2, firefox-0:128.14.0-2.el10_0, thunderbird-0:128.14.0-3.el10_0, firefox-0:128.14.0-2.el8_2, thunderbird-0:128.14.0-3.el8_4, thunderbird-0:128.14.0-3.el9_0, firefox-0:128.14.0-2.el9_4, thunderbird-0:128.14.0-3.el8_2, firefox-0:128.14.0-2.el8_4

receipt

Source: Red Hat
Its words: firefox-0:128.14.0-2.el8_10, thunderbird-0:128.14.0-3.el8_10, firefox-0:128.14.0-2.el9_6, firefox-0:128.14.0-2.el8_6, firefox-0:128.14.0-2.el7_9, firefox-0:128.14.0-2.el8_8, thunderbird-0:128.14.0-3.el9_6, thunderbird-0:128.14.0-3.el8_8, firefox-0:128.14.0-2.el9_0, thunderbird-0:128.14.0-3.el9_4, thunderbird-0:128.14.0-3.el8_6, firefox-0:128.14.0-2.el9_2, thunderbird-0:128.14.0-3.el9_2, firefox-0:128.14.0-2.el10_0, thunderbird-0:128.14.0-3.el10_0, firefox-0:128.14.0-2.el8_2, thunderbird-0:128.14.0-3.el8_4, thunderbird-0:128.14.0-3.el9_0, firefox-0:128.14.0-2.el9_4, thunderbird-0:128.14.0-3.el8_2, firefox-0:128.14.0-2.el8_4
Read by: field:affected_packages[]
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2025-9181",
  "CWE": "CWE-665",
  "advisories": [
    "RHSA-2025:15423",
    "RHSA-2025:15434",
    "RHSA-2025:15424",
    "RHSA-2025:15435",
    "RHSA-2025:14743",
    "RHSA-2025:15535",
    "RHSA-2025:15436",
    "RHSA-2025:15437",
    "RHSA-2025:14844",
    "RHSA-2025:15438",
    "RHSA-2025:14416",
    "RHSA-2025:14417",
    "RHSA-2025:15418",
    "RHSA-2025:15419",
    "RHSA-2025:15430",
    "RHSA-2025:15496",
    "RHSA-2025:15420",
    "RHSA-2025:14442",
    "RHSA-2025:14640",
    "RHSA-2025:15421",
    "RHSA-2025:15422"
  ],
  "affected_packages": [
    "firefox-0:128.14.0-2.el8_10",
    "thunderbird-0:128.14.0-3.el8_10",
    "firefox-0:128.14.0-2.el9_6",
    "firefox-0:128.14.0-2.el8_6",
    "firefox-0:128.14.0-2.el7_9",
    "firefox-0:128.14.0-2.el8_8",
    "thunderbird-0:128.14.0-3.el9_6",
    "thunderbird-0:128.14.0-3.el8_8",
    "firefox-0:128.14.0-2.el9_0",
    "thunderbird-0:128.14.0-3.el9_4",
    "thunderbird-0:128.14.0-3.el8_6",
    "firefox-0:128.14.0-2.el9_2",
    "thunderbird-0:128.14.0-3.el9_2",
    "firefox-0:128.14.0-2.el10_0",
    "thunderbird-0:128.14.0-3.el10_0",
    "firefox-0:128.14.0-2.el8_2",
    "thunderbird-0:128.14.0-3.el8_4",
    "thunderbird-0:128.14.0-3.el9_0",
    "firefox-0:128.14.0-2.el9_4",
    "thunderbird-0:128.14.0-3.el8_2",
    "firefox-0:128.14.0-2.el8_4"
  ],
  "bugzilla": "2389583",
  "bugzilla_description": "thunderbird: firefox: Uninitialized memory in the JavaScript Engine component",
  "cvss3_score": "6.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-08-19T20:33:55Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-9181.json",
  "severity": "moderate"
}

—

Product

product

NVD

Firefox

receipt

Source: NVD
Its words: Firefox
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	MEDIUM
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

medium

Severity

severity

Red Hat

moderate

A flaw that is harder to exploit, or whose impact is limited.

receipt

Source: Red Hat
Its words: moderate
Read by: field:severity
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2025-9181",
  "CWE": "CWE-665",
  "advisories": [
    "RHSA-2025:15423",
    "RHSA-2025:15434",
    "RHSA-2025:15424",
    "RHSA-2025:15435",
    "RHSA-2025:14743",
    "RHSA-2025:15535",
    "RHSA-2025:15436",
    "RHSA-2025:15437",
    "RHSA-2025:14844",
    "RHSA-2025:15438",
    "RHSA-2025:14416",
    "RHSA-2025:14417",
    "RHSA-2025:15418",
    "RHSA-2025:15419",
    "RHSA-2025:15430",
    "RHSA-2025:15496",
    "RHSA-2025:15420",
    "RHSA-2025:14442",
    "RHSA-2025:14640",
    "RHSA-2025:15421",
    "RHSA-2025:15422"
  ],
  "affected_packages": [
    "firefox-0:128.14.0-2.el8_10",
    "thunderbird-0:128.14.0-3.el8_10",
    "firefox-0:128.14.0-2.el9_6",
    "firefox-0:128.14.0-2.el8_6",
    "firefox-0:128.14.0-2.el7_9",
    "firefox-0:128.14.0-2.el8_8",
    "thunderbird-0:128.14.0-3.el9_6",
    "thunderbird-0:128.14.0-3.el8_8",
    "firefox-0:128.14.0-2.el9_0",
    "thunderbird-0:128.14.0-3.el9_4",
    "thunderbird-0:128.14.0-3.el8_6",
    "firefox-0:128.14.0-2.el9_2",
    "thunderbird-0:128.14.0-3.el9_2",
    "firefox-0:128.14.0-2.el10_0",
    "thunderbird-0:128.14.0-3.el10_0",
    "firefox-0:128.14.0-2.el8_2",
    "thunderbird-0:128.14.0-3.el8_4",
    "thunderbird-0:128.14.0-3.el9_0",
    "firefox-0:128.14.0-2.el9_4",
    "thunderbird-0:128.14.0-3.el8_2",
    "firefox-0:128.14.0-2.el8_4"
  ],
  "bugzilla": "2389583",
  "bugzilla_description": "thunderbird: firefox: Uninitialized memory in the JavaScript Engine component",
  "cvss3_score": "6.1",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-08-19T20:33:55Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-9181.json",
  "severity": "moderate"
}

medium

Status

status

NVD

Modified

receipt

Source: NVD
Its words: Modified
Read by: field:cve.vulnStatus
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 11:54 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 11:54 UTC	partial
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Mozilla

receipt

Source: NVD
Its words: Mozilla
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Firefox",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "product": "Thunderbird",
            "vendor": "Mozilla",
            "versions": [
              {
                "lessThanOrEqual": "128.*",
                "status": "unaffected",
                "version": "128.14",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "140.*",
                "status": "unaffected",
                "version": "140.2",
                "versionType": "rpm"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "142",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "source": "security@mozilla.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "BAD1D73A-EC78-41F8-9FE8-4081A9FCE716",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249",
                "versionEndExcluding": "128.14.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D",
                "versionEndExcluding": "142.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4",
                "versionEndExcluding": "140.2.0",
                "versionStartIncluding": "140.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."
      },
      {
        "lang": "es",
        "value": "Memoria sin inicializar en el componente JavaScript Engine. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."
      }
    ],
    "id": "CVE-2025-9181",
    "lastModified": "2026-10-05T15:10:00.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-9181",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-08-20T14:05:26.357732Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-08-19T21:15:30.520",
    "references": [
      {
        "source": "security@mozilla.org",
        "tags": [
          "Issue Tracking",
          "Permissions Required"
        ],
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1977130"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"
      },
      {
        "source": "security@mozilla.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"
      }
    ],
    "sourceIdentifier": "security@mozilla.org",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

thunderbird: firefox: Uninitialized memory in the JavaScript Engine component zetlyn/cve-redhat · 2025-08-19	cvss 6.1 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cwe CWE-665 packages firefox-0:128.14.0-2.el8_10, thunderbird-0:128.14.0-3.el8_10, firefox-0:128.14.0-2.el9_6, firefox-0:128.14.0-2.el8_6, firefox-0:128.14.0-2.el7_9, firefox-0:128.14.0-2.el8_8, thunderbird-0:128.14.0-3.el9_6, thunderbird-0:128.14.0-3.el8_8, firefox-0:128.14.0-2.el9_0, thunderbird-0:128.14.0-3.el9_4, thunderbird-0:128.14.0-3.el8_6, firefox-0:128.14.0-2.el9_2, thunderbird-0:128.14.0-3.el9_2, firefox-0:128.14.0-2.el10_0, thunderbird-0:128.14.0-3.el10_0, firefox-0:128.14.0-2.el8_2, thunderbird-0:128.14.0-3.el8_4, thunderbird-0:128.14.0-3.el9_0, firefox-0:128.14.0-2.el9_4, thunderbird-0:128.14.0-3.el8_2, firefox-0:128.14.0-2.el8_4 severity moderate	source
Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2. zetlyn/cve-nvd · 2025-08-19	automatable no cvss 6.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N cwe CWE-457 exploitation none product Firefox severity MEDIUM status Modified technical_impact partial vendor Mozilla	source