CVE-2025-4919 is a memory safety vulnerability in Mozilla Firefox involving out-of-bounds access on JavaScript objects due to confusion in array index sizes. This can lead to unauthorized read or write operations in memory, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the affected system. The issue was reported by Manfred Paul in collaboration with Trend Micro's Zero Day Initiative. Mozilla fixed this vulnerability in Firefox 138.0.4 and Firefox ESR 128.10.1, as well as in Thunderbird versions 128.10.2 and 138.0.2. The CVSS v3.1 base score is 8.8, reflecting high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to perform out-of-bounds memory reads or writes on JavaScript objects within Firefox, which can lead to arbitrary code execution or browser compromise. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 138.0.4, Firefox ESR 128.10.1, Thunderbird 128.10.2, and Thunderbird 138.0.2. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisories linked in the input data.