6.5
Medium
CVE-2025-8027 On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack
Description
On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 141 | earliest → < 141 | 141 |
| Firefox 140.1 | earliest → < 140.1 | 140.1 |
| Firefox 128.13 | earliest → < 128.13 | 128.13 |
| Firefox 115.26 | earliest → < 115.26 | 115.26 |
| Firefox ESR 140.1 | earliest → < 140.1 | 140.1 |
| Thunderbird 141 | earliest → < 141 | 141 |
| Thunderbird 140.1 | earliest → < 140.1 | 140.1 |
| Thunderbird 128.13 | earliest → < 128.13 | 128.13 |