CVE-2025-9179
📋 TL;DR
This critical memory corruption vulnerability in Mozilla's GMP (Gecko Media Plugin) process allows attackers to potentially execute arbitrary code or cause denial of service. It affects Firefox, Firefox ESR, and Thunderbird users running vulnerable versions. The GMP process handles encrypted media and has different privileges than the main content process despite sandboxing.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or installation of persistent malware.
Likely Case
Browser/application crash (denial of service) or limited code execution within sandbox constraints.
If Mitigated
Sandbox escape prevented, but application instability or crashes may still occur.
🎯 Exploit Status
Memory corruption vulnerabilities in sandboxed processes require additional exploitation to escape sandbox. No public exploit available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, Thunderbird 140.2
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-64/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart when prompted. 5. Verify version matches patched versions above.
🔧 Temporary Workarounds
Disable GMP/Encrypted Media
allDisable Gecko Media Plugin functionality to prevent exploitation via encrypted media.
about:config → Set 'media.gmp.enabled' to false
about:config → Set 'media.eme.enabled' to false
🧯 If You Can't Patch
- Implement network filtering to block malicious sites and restrict web content access.
- Use application control to prevent execution of vulnerable versions and enforce use of updated alternatives.
🔍 How to Verify
Check if Vulnerable:
Check browser version: Firefox/Thunderbird → Help → About. Compare against affected versions list.Check Version:
firefox --version or thunderbird --version (Linux/macOS), or check About dialog in GUI.Verify Fix Applied:
Verify version matches patched versions: Firefox 142+, Firefox ESR 115.27+, 128.14+, 140.2+, Thunderbird 142+, 128.14+, 140.2+.📡 Detection & Monitoring
Log Indicators:
- Browser/application crashes with GMP process
- Unexpected process termination in application logs
- Sandbox violation alerts
Network Indicators:
- Unusual encrypted media requests to suspicious domains
- Exploit kit traffic patterns
SIEM Query:
source="browser_logs" AND (process="GMP" OR process="plugin-container") AND (event="crash" OR event="exception")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1979527
- https://www.mozilla.org/security/advisories/mfsa2025-64/
- https://www.mozilla.org/security/advisories/mfsa2025-65/
- https://www.mozilla.org/security/advisories/mfsa2025-66/
- https://www.mozilla.org/security/advisories/mfsa2025-67/
- https://www.mozilla.org/security/advisories/mfsa2025-70/
- https://www.mozilla.org/security/advisories/mfsa2025-71/
- https://www.mozilla.org/security/advisories/mfsa2025-72/
- https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html
