CVE-2025-8027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8027
On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-56/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-57/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-59/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-61/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-63/ Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
History

13 Apr 2026, 15:17

Type Values Removed Values Added
Summary (en) On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. (en) On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

03 Nov 2025, 20:19

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html -

28 Jul 2025, 18:30

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1968423 - Permissions Required
References () https://www.mozilla.org/security/advisories/mfsa2025-56/ - () https://www.mozilla.org/security/advisories/mfsa2025-56/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-57/ - () https://www.mozilla.org/security/advisories/mfsa2025-57/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-58/ - () https://www.mozilla.org/security/advisories/mfsa2025-58/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-59/ - () https://www.mozilla.org/security/advisories/mfsa2025-59/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-61/ - () https://www.mozilla.org/security/advisories/mfsa2025-61/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-62/ - () https://www.mozilla.org/security/advisories/mfsa2025-62/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-63/ - () https://www.mozilla.org/security/advisories/mfsa2025-63/ - Vendor Advisory
First Time Mozilla
Mozilla firefox
Mozilla thunderbird
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

23 Jul 2025, 14:15

Type Values Removed Values Added
CWE CWE-457
Summary
  • (es) En plataformas de 64 bits, IonMonkey-JIT solo escribía 32 bits del espacio de valor de retorno de 64 bits en la pila. Sin embargo, Baseline-JIT leía los 64 bits completos. Esta vulnerabilidad afecta a Firefox &lt; 141, Firefox ESR &lt; 115.26, Firefox ESR &lt; 128.13, Firefox ESR &lt; 140.1, Thunderbird &lt; 141, Thunderbird &lt; 128.13 y Thunderbird &lt; 140.1.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

22 Jul 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-22 21:15

Updated : 2026-04-13 15:17

NVD link : CVE-2025-8027

Mitre link : CVE-2025-8027

CVE.ORG link : CVE-2025-8027

JSON object : View

Products Affected

mozilla

  • firefox
  • thunderbird
CWE
CWE-457

Use of Uninitialized Variable