CVE-2025-1012 Details
Description
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
A use-after-free vulnerability has been identified in Mozilla Firefox and Thunderbird. This issue arises from a race condition during concurrent delazification, which could potentially be exploited. The vulnerability affects multiple versions of Firefox and Thunderbird, including Firefox prior to 135, Firefox ESR versions prior to 115.20 and 128.7, as well as Thunderbird versions prior to 128.7 and 135.
Users can upgrade to Firefox 135, Firefox ESR 115.20 or 128.7, or Thunderbird 128.7 or 135 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mozilla firefox | < 115.20.0 < 135.0 >= 128.1.0, < 128.7.0 |
CPE
Remediation
| |
| mozilla thunderbird | < 135.0 >= 128.0.1, < 128.7.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Feb 6, 2025 | Initial Analysis | [email protected] |
| Feb 5, 2025 | CVE Modified | CISA-ADP |
| Feb 4, 2025 | New CVE Received | [email protected] |