The vulnerability CVE-2025-1942 affects Mozilla Firefox and Thunderbird and involves the String.toUpperCase() JavaScript method. When this method causes the string to grow in length, uninitialized memory could be included in the output string. This is a memory disclosure issue classified under CWE-908. The flaw was fixed in Firefox 136 and Thunderbird 136. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can lead to high impact on confidentiality, integrity, and availability. The Mozilla advisories mfsa2025-14 and mfsa2025-17 provide detailed information and confirm the fix.

Successful exploitation of this vulnerability could lead to disclosure of uninitialized memory contents, potentially exposing sensitive information. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported. The vulnerability affects Firefox and Thunderbird prior to version 136.

This vulnerability is fixed in Mozilla Firefox 136 and Thunderbird 136. Users and administrators should upgrade to these versions or later to remediate the issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official update. Patch status is confirmed by the vendor advisories at https://www.mozilla.org/security/advisories/mfsa2025-14/ and https://www.mozilla.org/security/advisories/mfsa2025-17/. No temporary or alternative mitigations are indicated.