CVE-2025-8035 encompasses multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 141 and Thunderbird 141, including ESR releases 128.12 and 140.0. These bugs involve memory corruption issues that, with sufficient effort, could allow arbitrary code execution. The vulnerabilities are categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Mozilla has released official patches in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1 to address these issues. The CVSS v3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, potentially compromising the confidentiality, integrity, and availability of affected systems. The vulnerabilities affect widely used Firefox and Thunderbird versions, posing a significant risk if unpatched. No known active exploits have been reported, but the high CVSS score reflects the critical nature of the underlying memory corruption issues.

Official patches addressing CVE-2025-8035 are available and have been released by Mozilla in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1. Users and administrators should update affected Firefox and Thunderbird installations to these fixed versions or later to mitigate the vulnerabilities. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by the vendor advisory.