This advisory covers two out-of-bounds access vulnerabilities in Mozilla Firefox and Thunderbird, tracked as CVE-2025-4918 and CVE-2025-4919. The first vulnerability involves out-of-bounds access when resolving Promise objects, and the second involves out-of-bounds access during optimization of linear sums. Both vulnerabilities are classified under CWE-787. Red Hat has released security updates for Firefox packages on Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple hardware architectures. The update addresses these vulnerabilities to prevent potential security issues. No CVSS score is provided in the advisory, but the impact is rated as important by Red Hat Product Security.

The vulnerabilities allow out-of-bounds memory access in Firefox and Thunderbird, which could potentially lead to memory corruption or other unintended behavior. The advisory does not specify exploitation in the wild or detailed impact scenarios. The security impact is rated as important by Red Hat, indicating a significant risk if unpatched.

Red Hat has released an official security update for Firefox that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the Firefox update version 128.10.1-1.el9_0 or later as provided by Red Hat to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are specified or required beyond applying the official update.