CVE-2025-10528

HIGH

Firefox < 143 - Memory Corruption

Title source: llm

Description

Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.

References (7)

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html

[Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1986185

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-73/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-75/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-77/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-78/

Scores

CVSS v3 7.3

EPSS 0.0008

EPSS Percentile 23.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-693

Status published

Affected Products (3)

mozilla/firefox < 140.3.0

mozilla/firefox < 143.0

mozilla/thunderbird < 140.3.0

Timeline

Published Sep 16, 2025

Tracked Since Feb 18, 2026