CVE-2025-1009
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 1.21%
- 67th pct
- KEV
- No
- Class
- oss containerizable
- CWE-416, CWE-416
Description
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1936613
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-08/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
Status: profiled · ingested 2026-10-05T18:00:53.000Z