vulnerability

MFSA2025-58 Firefox: Security Vulnerabilities fixed in Firefox ESR 128.13 (CVE-2025-8033)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:C/I:N/A:N)

Published

Jul 22, 2025

Added

Jul 23, 2025

Modified

Apr 15, 2026

Description

The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Solution

mozilla-firefox-esr-upgrade-128_13

References

CVE-2025-8033
https://attackerkb.com/topics/CVE-2025-8033
CWE-476
EUVD-EUVD-2025-22362
http://www.mozilla.org/security/announce/2025/mfsa2025-58.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22362

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report