CVE-2025-6436
Memory safety bugs fixed in Firefox 140 and Thunderbird 140
CVSS v3
8.1
HIGH
EPSS Score
4.3 %
exploit probability, as of 2026-09-25
CISA KEV
No
known exploited
Exploitation
none
SSVC status
Description
Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
Technical details
- Published
- 2025-06-24
- Last Modified
- 2026-04-13
Frequently asked questions
What is CVE-2025-6436?
Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
Is CVE-2025-6436 actively exploited?
Active exploitation of CVE-2025-6436 has not been confirmed. Its EPSS score was 4.3% on 2026-09-25, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-6436?
CVE-2025-6436 has a CVSS v3 base score of 8.1 (HIGH severity).
Is CVE-2025-6436 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2025 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).
- CVE-2025-53770KEVMicrosoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2025-49704KEVMicrosoft SharePoint Remote Code Execution Vulnerability
- CVE-2025-3248KEV
- CVE-2025-22457KEV
- CVE-2025-59287KEV
- CVE-2025-0282KEV
- CVE-2025-31161KEV
- CVE-2025-5777KEVNetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread