CVE-2025-1016: Critical Memory Safety Bugs in Firefox and Thunderbird

CVE-2025-1016 is a critical memory safety flaw (CVSS 9.8) in Mozilla Firefox and Thunderbird. It was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7 and Thunderbird 135. If you run an older build, update the browser or mail client and restart it.

What's affected

Mozilla's description in the record reads: "Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code."

Fixed versions named in the record are Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7 and Thunderbird 135. Anything older in the same release lines should be treated as affected. Mozilla published the fixes in security advisories MFSA 2025-07 through MFSA 2025-11, one per product and release line. Check the advisory that matches your build.

The weakness is CWE-787 (out-of-bounds write). The record scores it 9.8 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Mozilla rates this advisory entry as high impact.

How to check if you're exposed

Check the version of every Firefox and Thunderbird install you manage, including ESR installs on shared and kiosk machines.

1. In Firefox or Thunderbird, open the About dialog from the Help menu. It shows the version and starts an update check.
2. From a terminal on a managed machine, ask the binary directly.

firefox --version
thunderbird --version

3. On Debian based systems the package manager tells you what the distribution has shipped.

apt list --installed 2>/dev/null | grep -E "firefox|thunderbird"

4. Compare the result against the fixed versions above. Distributions sometimes backport fixes without changing the upstream version number, so confirm with the distribution's own advisory if the number looks old. The record's references include a Debian LTS announcement for one of these CVEs.

What to do now

1. Update Firefox to 135 or later, or Firefox ESR to 115.20 or 128.7 or later, depending on your release line.
2. Update Thunderbird to 128.7 or 135 or later. The record lists Thunderbird 115.x as affected for some of these bugs, so check the advisory if you still run that line.
3. Restart the application. An update does not protect a running session until it relaunches.
4. For managed fleets, push the update through your software deployment tool and report on machines that still run older builds.
5. Add browsers and mail clients to your software inventory. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.

This CVE is a roll-up of several memory safety bugs found by Mozilla's own engineers, tracked in Bugzilla. A roll-up means there is no single trigger to block, so the only dependable answer is the update.

Why it matters

Browsers and mail clients parse content from strangers all day, and they are written largely in languages where the programmer manages memory. When a bug lets memory be read, written or freed at the wrong time, an attacker who controls the content can sometimes turn a crash into something worse. Mozilla's own wording is careful: it describes a potentially exploitable crash, or says it presumes some bugs could have been exploited with enough effort.

The record is not marked as exploited in the wild by CISA, and Mozilla's advisory does not say these bugs were exploited. The practical risk is still real, because browsers are everywhere and updates are cheap. Patch within your normal window for browser fixes, and sooner where users open untrusted web pages or email.

Quick check

Sources

• Mozilla Foundation Security Advisory 2025-07
• Mozilla advisory index for the related ESR and Thunderbird advisories, MFSA 2025-09
• NVD record for CVE-2025-1016

Last reviewed: 19 October 2026.