CVE-2025-8027: firefox — Fix

Description

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Is your site exposed to CVE-2025-8027?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-457 CWE-457

Affected Products

Vendor	Product	Versions
mozilla	firefox	< 115.26.0
mozilla	firefox	< 141.0
mozilla	firefox	128.0 — 128.13.0
mozilla	firefox	140.0 — 140.1.0
mozilla	thunderbird	< 128.13.0
mozilla	thunderbird	< 141.0
mozilla	thunderbird	140.0 — 140.1.0

References

Advisories & Patches

https://www.mozilla.org/security/advisories/mfsa2025-56/ https://www.mozilla.org/security/advisories/mfsa2025-57/ https://www.mozilla.org/security/advisories/mfsa2025-58/ https://www.mozilla.org/security/advisories/mfsa2025-59/ https://www.mozilla.org/security/advisories/mfsa2025-61/ https://www.mozilla.org/security/advisories/mfsa2025-62/ https://www.mozilla.org/security/advisories/mfsa2025-63/

Other References

https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html

Frequently Asked Questions

What is CVE-2025-8027? +

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-8027? +

CVE-2025-8027 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-8027? +

CVE-2025-8027 affects products from mozilla, specifically: firefox, thunderbird. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-8027? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-26383

The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the …

CVE-2025-10021

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object …

CVE-2026-17667

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a …

CVE-2026-17668

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a …

CVE-2026-17689

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a …

CVE-2026-17707

Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the …

CVE-2025-8027

Description

CVSS v3.1 Score

Weakness Type (CWE)

Affected Products

References

Advisories & Patches

Other References

Frequently Asked Questions

Related Vulnerabilities

Don't wait for an exploit