CVE-2025-9179

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9179", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-08-19T15:55:37.418Z", "datePublished": "2025-08-19T20:33:53.949Z", "dateUpdated": "2026-04-13T14:25:47.601Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "115.27", "lessThanOrEqual": "115.*", "versionType": "rpm"}, {"status": "unaffected", "version": "128.14", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "140.2", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "142", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.14", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "140.2", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "142", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."}]}], "title": "Sandbox escape due to invalid pointer in the Audio/Video: GMP component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1979527"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-65/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"}], "credits": [{"lang": "en", "value": "Oskar"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:47.601Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-08-20T14:06:11.940109Z", "id": "CVE-2025-9179", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T15:18:57.429Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:14:10.275Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:14:10.275Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-9179", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-20T14:06:11.940109Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T14:06:17.281Z"}}], "cna": {"title": "Sandbox escape due to invalid pointer in the Audio/Video: GMP component", "credits": [{"lang": "en", "value": "Oskar"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "115.27", "versionType": "rpm", "lessThanOrEqual": "115.*"}, {"status": "unaffected", "version": "128.14", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "140.2", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "142", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "128.14", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "140.2", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "142", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1979527"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-65/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"}], "descriptions": [{"lang": "en", "value": "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.", "supportingMedia": [{"type": "text/html", "value": "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:47.601Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9179", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:25:47.601Z", "dateReserved": "2025-08-19T15:55:37.418Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-08-19T20:33:53.949Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "115.*", "status": "unaffected", "version": "115.27", "versionType": "rpm"}, {"lessThanOrEqual": "128.*", "status": "unaffected", "version": "128.14", "versionType": "rpm"}, {"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.2", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "142", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "128.*", "status": "unaffected", "version": "128.14", "versionType": "rpm"}, {"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.2", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "142", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "EA30840B-9687-4BD4-B2F6-7557A75D2C5C", "versionEndExcluding": "115.27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "9F095AEE-D972-4427-A063-5CA441E4D1A5", "versionEndExcluding": "142.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "02EDFC2B-306B-4DF6-B2DE-8E2B405727B2", "versionEndExcluding": "128.14.0", "versionStartIncluding": "128.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "4FEE0509-E29D-4C59-A920-60E804499A78", "versionEndExcluding": "140.2.0", "versionStartIncluding": "140.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "matchCriteriaId": "DCD60324-B41D-4408-B4EF-274DF15E1249", "versionEndExcluding": "128.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "matchCriteriaId": "44E5E769-8961-46D3-90E5-DFA27D979F7D", "versionEndExcluding": "142.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "matchCriteriaId": "28D57F8E-9E36-415C-9A56-8ED3A3B755D4", "versionEndExcluding": "140.2.0", "versionStartIncluding": "140.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."}, {"lang": "es", "value": "Un atacante logr\u00f3 corromper la memoria en el proceso GMP, que procesa medios cifrados. Este proceso tambi\u00e9n est\u00e1 fuertemente protegido, pero sus privilegios son ligeramente diferentes a los del proceso de contenido. Esta vulnerabilidad afecta a Firefox menor que 142, Firefox ESR menor que 115.27, Firefox ESR menor que 128.14, Firefox ESR menor que 140.2, Thunderbird menor que 142, Thunderbird menor que 128.14 y Thunderbird menor que 140.2."}], "id": "CVE-2025-9179", "lastModified": "2026-10-05T15:10:00.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9179", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-20T14:06:11.940109Z", "version": "2.0.3"}}]}, "published": "2025-08-19T21:15:30.247", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1979527"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-64/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-65/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-66/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-67/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-70/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-71/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-72/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component", "id": "2389580", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2389580"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-119", "details": ["An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2.", "A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker is able to perform memory corruption in the GMP process which process encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process."], "name": "CVE-2025-9179", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/firefox-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/thunderbird-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-19T20:33:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-9179\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-9179\nhttps://www.mozilla.org/security/advisories/mfsa2025-66/#CVE-2025-9179\nhttps://www.mozilla.org/security/advisories/mfsa2025-71/#CVE-2025-9179"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T16:51:31.918831+00:00", "value": {"mitigation_remediation": ["Upgrade Mozilla Firefox to version 142 or later, or update to the latest Firefox ESR release (115.27, 128.14, or 140.2).", "Upgrade Mozilla Thunderbird to version 142 or later, or update to the latest Thunderbird ESR release (128.14 or 140.2).", "If an immediate upgrade is not possible, block or disable the loading of encrypted media content in the affected browsers until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Sandbox escape that can lead to arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Mozilla Firefox and Mozilla Thunderbird are affected. Versions prior to Firefox 142, Firefox ESR 115.27, 128.14, and 140.2, as well as Thunderbird 142, 128.14, and 140.2, are vulnerable. The fix is available in the listed releases and later. All other Mozilla products not listed here are not reported to be affected.", "description_and_impact": "An attacker who can influence the encrypted media processing pipeline can corrupt memory inside the GMP process, a sandboxed component of Mozilla applications. This overflow type flaw, identified as CWE\u2011119, allows a sandbox escape that can give the attacker arbitrary code execution or privilege escalation within the user\u2019s system. The severity is high, reflected in the CVSS score of 9.8, because once the sandbox is breached, the attacker can run any code with the same rights as the application.", "risk_and_exploitability": "The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild at the time of this analysis. However, the CVSS of 9.8 highlights a maximum impact if exploited. The vulnerability is not currently listed in the CISA KEV catalog, meaning that there is no widespread evidence of active exploitation, but the attack vector is a memory corruption in a sandboxed media component, which requires content that triggers the bad pointer handling. The combination of high severity and limited exploitation probability suggests a high-impact, low-probability risk profile."}}}}, "created": "2025-08-21T12:31:51.608814+00:00", "updated": "2026-04-20T17:00:12.731588+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$firefox", "mozilla$PRODUCT$firefox_esr", "mozilla$PRODUCT$thunderbird"]}