Red Hat Product Security issued an advisory (RHSA-2025:8125) for Mozilla Firefox on Red Hat Enterprise Linux 10 addressing two out-of-bounds access vulnerabilities: CVE-2025-4918, occurring during Promise object resolution, and CVE-2025-4919, occurring during optimization of linear sums. These vulnerabilities are categorized under CWE-787 (Out-of-bounds Write). The advisory provides updated Firefox packages for multiple architectures and variants of Red Hat Enterprise Linux 10. The vulnerabilities have been fixed in Firefox version 128.10.1-1.el10_0. No CVSS scores are provided in the advisory. No evidence of exploitation in the wild is reported.

Successful exploitation of these out-of-bounds access vulnerabilities could potentially lead to memory corruption, which might be leveraged for arbitrary code execution or application crashes. However, the advisory does not detail specific impacts beyond the classification of the vulnerabilities. No known exploits have been observed in the wild.

Red Hat has released updated Firefox packages (version 128.10.1-1.el10_0) for Red Hat Enterprise Linux 10 and its variants that address these vulnerabilities. Users should apply the available official updates as described in the Red Hat advisory (RHSA-2025:8125) to remediate these issues. Patch status is confirmed as fixed in these updated packages.