CVE-2025-1943

CVE-2025-1943 is a set of memory safety bugs (classified under CWE-122, heap-based buffer overflow) affecting Firefox 135 and Thunderbird 135. These bugs exhibited evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), highlighting its high severity due to network accessibility and low attack complexity.

Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction, potentially leading to memory corruption and, with advanced techniques, arbitrary code execution on affected systems. The impact primarily targets availability (high) and integrity (low), with no direct confidentiality loss, making it suitable for denial-of-service or code injection scenarios in browser or email client contexts.

Mozilla's security advisories (MFSA 2025-14 and MFSA 2025-17) and associated Bugzilla entries detail the fixes implemented in Firefox 136 and Thunderbird 136. Security practitioners should prioritize updating to these patched versions to mitigate the risks, as no workarounds are specified in the provided references.