This vulnerability (CVE-2025-9181) involves uninitialized memory usage within the JavaScript Engine component of Mozilla Firefox and Thunderbird products. It was reported by Irvan Kurniawan and is classified under CWE-457 (Use of Uninitialized Variable). The CVSS v3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The issue was fixed in Firefox 142 and ESR versions 128.14 and 140.2, as well as corresponding Thunderbird versions. The vendor advisory confirms the fix and provides references to the bug report (Bug 1977130).

The vulnerability could allow an attacker to gain access to uninitialized memory contents within the JavaScript Engine, potentially exposing sensitive information (high confidentiality impact). However, exploitation requires user interaction and no privileges are needed. There is no impact on integrity or availability. No known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird ESR 128.14, and Thunderbird ESR 140.2. Users and administrators should update to these versions or later to remediate the vulnerability. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.