Mozilla Firefox and Thunderbird Partial Return Value Stack Vulnerability

A vulnerability exists in the JavaScript engine of Mozilla Firefox and Thunderbird on 64-bit platforms. The IonMonkey Just-In-Time (JIT) compiler only wrote 32 bits of the 64-bit return value space to the stack, while the Baseline JIT read the entire 64 bits. This issue affects multiple versions of Firefox and Thunderbird.

Impact

Exploitation of this vulnerability could lead to incorrect handling of return values in JavaScript, potentially allowing for memory corruption or arbitrary code execution.

Remediation

Users can upgrade to Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141 or Thunderbird ESR 128.13 to address this vulnerability.