CVE-2025-9179 is a high-impact memory corruption vulnerability affecting the Gecko Media Plugin (GMP) process in Mozilla Firefox and Thunderbird. The GMP process, responsible for processing encrypted media, is sandboxed but operates with privileges distinct from the main content process. An attacker exploiting this flaw could achieve a sandbox escape, potentially leading to arbitrary code execution. Mozilla addressed this vulnerability in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2. The vulnerability is tracked under Bug 1979527 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploits have been observed. The vendor advisories (MFSA2025-64 and MFSA2025-65) provide detailed remediation information and confirm the fixes.

Successful exploitation of this vulnerability could allow an attacker to perform memory corruption in the GMP process, leading to a sandbox escape. This could result in arbitrary code execution with the privileges of the GMP process, which differ from the content process. The CVSS score of 9.8 reflects the critical nature of the impact, including confidentiality, integrity, and availability impacts rated as high. No known exploits in the wild have been reported at this time.

Official fixes for this vulnerability are available and have been released by Mozilla. Users and administrators should update to Firefox 142, Firefox ESR 115.27 (or later ESR versions 128.14, 140.2), Thunderbird 142, Thunderbird 128.14, or Thunderbird 140.2 to remediate this issue. Applying these updates will mitigate the vulnerability. No additional mitigation steps are required beyond applying the official patches.