Red Hat Product Security issued an advisory (RHSA-2025:8060) for Mozilla Firefox on Red Hat Enterprise Linux 8 addressing two out-of-bounds access vulnerabilities: CVE-2025-4918 occurs during Promise object resolution, and CVE-2025-4919 occurs during optimization of linear sums. These vulnerabilities are classified under CWE-787 (Out-of-bounds Write). Red Hat has released updated Firefox packages (version 128.10.1-1.el8_10) across multiple architectures including x86_64, s390x, ppc64le, and aarch64, including Extended Life Cycle versions 8.10. The advisory rates the security impact as Important and provides instructions for applying the update. No CVSS scores are provided in the advisory, and no known exploits have been reported.

Successful exploitation of these out-of-bounds access vulnerabilities could potentially lead to memory corruption, which may affect the stability or security of the Firefox browser. However, no known exploits in the wild have been reported. The vulnerabilities affect Firefox running on Red Hat Enterprise Linux 8 across multiple hardware architectures.

Red Hat has released updated Firefox packages that address these vulnerabilities. Users and administrators should apply the Firefox update version 128.10.1-1.el8_10 or later as provided by Red Hat for their respective architectures and Extended Life Cycle versions. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No additional mitigation actions are indicated by the vendor advisory.