The vulnerability CVE-2025-8033 involves incorrect state management in the JavaScript engine's handling of closed generators, which could be resumed improperly leading to a nullptr dereference (CWE-476). This flaw was present in multiple Firefox and Thunderbird versions and has been fixed in Firefox 141 and related ESR and Thunderbird releases. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges but requires user interaction, with high confidentiality impact but no integrity or availability impact. Mozilla's security advisories MFSA2025-56 and MFSA2025-57 confirm the issue and its remediation.

Successful exploitation could cause a nullptr dereference in the JavaScript engine, potentially leading to a crash or denial of service. The CVSS score of 6.5 reflects a medium severity with high confidentiality impact but no direct integrity or availability impact. There are no known exploits in the wild. The vulnerability does not appear to allow code execution or privilege escalation based on the advisory information.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate this issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisories.