CVE-2025-4918 is a critical security vulnerability in Firefox ESR where an attacker can perform an out-of-bounds read or write on a JavaScript Promise object. This flaw affects Firefox ESR versions prior to 128.10.1 and was reported by security researchers from Palo Alto Networks and Trend Micro's Zero Day Initiative. The vulnerability allows unauthorized memory access, potentially leading to information disclosure. Mozilla has released an official fix in Firefox ESR 128.10.1 and Firefox 138.0.4 to address this issue.