CVE-2025-4082

What it is

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-04-29 14:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-05 15:10 UTC Last updatedMost recent change to the record

Details

Published

2025-04-29 14:15 UTC

Last modified

2026-10-05 15:10 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Modified

Affected

• Mozilla Firefox < 115.23
• Mozilla Firefox < 138.0
• Mozilla Firefox < 128.10
• Mozilla Thunderbird < 128.10.0
• Mozilla Thunderbird < 138.0

Attack profile CVSS 3.1 · 5.9

Attack vector

Network

Complexity

High

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None