CVE-2025-4918 is a critical security vulnerability in Mozilla Firefox involving out-of-bounds memory access during the resolution of JavaScript Promise objects. This vulnerability allows an attacker to read or write memory outside the intended bounds, potentially leading to arbitrary code execution or other severe impacts. The flaw is tracked under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Mozilla fixed this issue in Firefox 138.0.4 and Firefox ESR 128.10.1, as well as Thunderbird 128.10.2 and 138.0.2. The vulnerability was responsibly disclosed by Edouard Bochin and Tao Yan from Palo Alto Networks in collaboration with Trend Micro's Zero Day Initiative. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to perform out-of-bounds memory reads or writes in the context of JavaScript Promise objects within Firefox or Thunderbird. This can lead to arbitrary code execution, data corruption, or application crashes, severely impacting confidentiality, integrity, and availability of the affected software. Given the critical CVSS score of 9.8, the impact is considered severe.

Mozilla has released official fixes for this vulnerability in Firefox 138.0.4, Firefox ESR 128.10.1, Thunderbird 128.10.2, and Thunderbird 138.0.2. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying these official updates.