CVE-2025-1942

When the String.toUpperCase() operation causes a string to expand (which occurs for some Unicode characters whose uppercase equivalents take up more space), the JavaScript engine does not properly initialize the entire required memory buffer. As a result, a fragment of uninitialized memory may be included in the resulting string (CWE-908: Use of Uninitialized Resource). An attacker could potentially exploit this mechanism through a crafted website or email message containing appropriate JavaScript code.

An attacker can gain access to sensitive data stored in uninitialized memory of the browser or mail client process, and in the worst case scenario — lead to a breach of application integrity or availability.

Mozilla Firefox should be updated to version 136 or later and Mozilla Thunderbird to version 136 or later. Patches are available directly from the vendor according to MFSA2025-14 and MFSA2025-17 references.

Mozilla Firefox versions prior to 136 and Mozilla Thunderbird versions prior to 136.