CVE-2025-10532: 
NixOS vulnerability analysis and mitigation

CVE-2025-10532 is a security vulnerability identified in the JavaScript Garbage Collection (GC) component of Mozilla Firefox and related products. The vulnerability was discovered by security researcher Gary Kwong and was disclosed on September 16, 2025. The issue affects Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird ESR 140.2 (Mozilla Advisory).

The vulnerability is characterized by incorrect boundary conditions in the JavaScript: GC component. It has been assessed with a moderate severity impact rating according to Mozilla's security assessment (Mozilla Advisory).

The vulnerability has been classified as having a moderate impact on affected systems. The issue is present in both Firefox and Thunderbird products, though in Thunderbird it cannot be exploited through email as scripting is disabled when reading mail. However, it remains a potential risk in browser or browser-like contexts (Mozilla Advisory).

The vulnerability has been addressed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird ESR 140.3. Users are advised to update to these versions to mitigate the security risk (Mozilla Advisory).