Red Hat Product Security issued an advisory (RHSA-2025:8807) for Mozilla Firefox and Thunderbird addressing two out-of-bounds access vulnerabilities: CVE-2025-4918 and CVE-2025-4919. These vulnerabilities involve improper memory handling during Promise resolution and linear sum optimization, respectively. The advisory applies to Red Hat Enterprise Linux 8.8 Extended Update Support and related variants. Red Hat has released updated Firefox packages (version 128.10.1-1.el8_8) to remediate these issues. The vulnerabilities are categorized under CWE-787 (Out-of-bounds Write). No CVSS base score is provided in the advisory, but the severity is rated as important by Red Hat.

The vulnerabilities allow out-of-bounds memory access in Firefox and Thunderbird, which can lead to potential memory corruption or crashes. The advisory does not specify exploitation in the wild or detailed impact scenarios. The issues affect the stability and security of the affected applications by enabling unexpected behavior due to improper memory handling.

Red Hat has released updated Firefox packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.8 Extended Update Support and related products should apply the Firefox update version 128.10.1-1.el8_8 or later as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.