CVE-2025-8035: 
NixOS vulnerability analysis and mitigation

CVE-2025-8035 is a memory safety vulnerability discovered in Mozilla Firefox and Thunderbird products. The vulnerability was reported by the Mozilla Fuzzing Team and disclosed on July 22, 2025. It affects Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140, and Thunderbird 140 versions (Mozilla Advisory).

The vulnerability is classified as a memory safety bug that shows evidence of memory corruption. The issue is tracked as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with a CVSS v3.1 base score of 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The vulnerability could potentially be exploited to run arbitrary code on affected systems. While these flaws cannot be exploited through email in Thunderbird due to disabled scripting when reading mail, they remain potential risks in browser or browser-like contexts (Mozilla Advisory).

The vulnerability has been fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1. Users are advised to upgrade to these patched versions (Red Hat Advisory).