CVE-2025-3030

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3030", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-03-31T09:35:24.249Z", "datePublished": "2025-04-01T12:29:00.640Z", "dateUpdated": "2026-04-13T14:26:02.951Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.9", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "137", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.9", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "137", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9."}]}], "title": "Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9", "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494", "name": "Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-20/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-22/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-23/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-24/"}], "credits": [{"lang": "en", "value": "Sylvestre Ledru, Paul Bone and the Mozilla Fuzzing Team"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:26:02.951Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-02T03:55:42.520128Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:29:04.826Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:46:50.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:46:50.996Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-02T03:55:42.520128Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T15:43:55.517Z"}}], "cna": {"title": "Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9", "credits": [{"lang": "en", "value": "Sylvestre Ledru, Paul Bone and the Mozilla Fuzzing Team"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "128.9", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "137", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "128.9", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "137", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494", "name": "Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-20/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-22/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-23/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-24/"}], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.", "supportingMedia": [{"type": "text/html", "value": "Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:26:02.951Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3030", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:26:02.951Z", "dateReserved": "2025-03-31T09:35:24.249Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-04-01T12:29:00.640Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "128.*", "status": "unaffected", "version": "128.9", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "137", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "128.*", "status": "unaffected", "version": "128.9", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "137", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "51A0498A-4BF8-4166-A347-78023C0A6B33", "versionEndExcluding": "128.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "0FD416E8-4DD8-434A-AD75-86F38562E720", "versionEndExcluding": "136.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3C5A2B6-C7B5-4888-B0A7-9DA0C3024C71", "versionEndExcluding": "128.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "93C81C9D-FC2E-4D7D-A97F-8DB97ED92192", "versionEndExcluding": "136.0", "versionStartIncluding": "129.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9."}, {"lang": "es", "value": "Errores de seguridad de memoria presentes en Firefox 136, Thunderbird 136, Firefox ESR 128.8 y Thunderbird 128.8. Algunos de estos errores mostraron evidencia de corrupci\u00f3n de memoria y presumimos que, con suficiente esfuerzo, algunos de ellos podr\u00edan haberse explotado para ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta a Firefox menor que 137, Firefox ESR menor que 128.9, Thunderbird menor que 137 y Thunderbird menor que 128.9."}], "id": "CVE-2025-3030", "lastModified": "2026-10-05T15:10:00.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3030", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-02T03:55:42.520128Z", "version": "2.0.3"}}]}, "published": "2025-04-01T13:15:41.390", "references": [{"source": "security@mozilla.org", "tags": ["Broken Link", "Issue Tracking"], "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-20/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-22/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-23/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-24/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:7491", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "firefox-0:128.9.0-3.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:7493", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "thunderbird-0:128.9.0-2.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:3628", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "firefox-0:128.9.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:3582", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:128.9.0-2.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4170", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:128.9.0-2.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-04-24T00:00:00Z"}, {"advisory": "RHSA-2025:3623", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:128.9.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:4032", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:128.9.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3581", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "firefox-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4031", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3581", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "firefox-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4031", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "thunderbird-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3581", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "firefox-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4031", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "thunderbird-0:128.9.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3621", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "firefox-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:4030", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "thunderbird-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3621", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "firefox-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:4030", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "thunderbird-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3621", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "firefox-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:4030", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "thunderbird-0:128.9.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3620", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "firefox-0:128.9.0-2.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-04-07T00:00:00Z"}, {"advisory": "RHSA-2025:4029", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "thunderbird-0:128.9.0-2.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3556", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:128.9.0-2.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4169", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:128.9.0-2.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-04-24T00:00:00Z"}, {"advisory": "RHSA-2025:3587", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "firefox-0:128.9.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4028", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "thunderbird-0:128.9.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3589", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "firefox-0:128.9.0-2.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4027", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "thunderbird-0:128.9.0-2.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-04-23T00:00:00Z"}, {"advisory": "RHSA-2025:3590", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "firefox-0:128.9.0-2.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-04-03T00:00:00Z"}, {"advisory": "RHSA-2025:4026", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "thunderbird-0:128.9.0-2.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-04-23T00:00:00Z"}], "bugzilla": {"description": "firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9", "id": "2356563", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2356563"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-120", "details": ["Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9.", "A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code."], "name": "CVE-2025-3030", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox-flatpak-container", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird-flatpak-container", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-01T12:29:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-3030\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-3030\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494\nhttps://www.mozilla.org/security/advisories/mfsa2025-20/\nhttps://www.mozilla.org/security/advisories/mfsa2025-22/\nhttps://www.mozilla.org/security/advisories/mfsa2025-23/\nhttps://www.mozilla.org/security/advisories/mfsa2025-24/"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T18:17:05.858609+00:00", "value": {"mitigation_remediation": ["Upgrade Mozilla Firefox to version 137 or later, or Firefox ESR 128.9 or later", "Upgrade Mozilla Thunderbird to version 137 or later, or Thunderbird 128.9 or later", "If an upgrade is not immediately possible, disable or uninstall the affected browser versions to prevent the vulnerability from being exposed during user interactions"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Mozilla Firefox and Thunderbird products running the specified affected versions, namely Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Upgrades to Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 contain the fixes and are required to eliminate the risk. The CVE report lists Red\u00a0Hat Enterprise Linux platforms in its CPEs, but those are not directly impacted by the bugs in the browser code.", "description_and_impact": "Memory corruption bugs were discovered in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. The defects could lead to arbitrary code execution if an attacker supplies crafted data that triggers the corruption, allowing the attacker to gain code execution with the privileges of the user running the browser. The weaknesses involve unsafe buffer handling and use-after-free logic, as indicated by CWE-120 and CWE-416. The impact is a severe compromise of confidentiality, integrity, and availability for the affected user or system.", "risk_and_exploitability": "The CVSS score of 8.1 signifies high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not present in CISA's KEV catalog. Likely exploitation would involve an attacker delivering malicious content\u2014such as a web page, a multimedia file, or an email attachment\u2014to a user running an affected browser. Successful exploitation would require the target to open or process the crafted content, after which arbitrary code could run in the browser's context."}}}}, "created": "2026-04-20T18:30:13.976023+00:00", "updated": "2026-04-20T18:30:13.976039+00:00", "vendors": []}