CVE-2023-25746

HighCVSS 8.8

Published: 02/06/2023(UTC)Updated: 23/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.67%

51th percentile - higher than 51% of all known CVEs

Summary

Memory safety bugs are present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some could have been exploited to run arbitrary code. The vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Risk Assessment

The vulnerability could lead to arbitrary code execution in the context of the browser or email client process, potentially resulting in full system compromise by an attacker.

Recommendation

Update Thunderbird to version 102.8 or later and Firefox ESR to version 102.8 or later.

Other vulnerabilities in Firefox ESR

CVE-2026-118027Critical
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.

Original NVD description (English source)

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS