Description
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.
References (6)
Core 6
Core References
Permissions Required
https://bugzilla.mozilla.org/show_bug.cgi?id=1952465
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-28/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-29/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-31/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-32/
Scores
CVSS v3
4.8
EPSS
0.0044
EPSS Percentile
63.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (8)
mozilla/firefox
< 128.10
mozilla/firefox
< 138.0
Mozilla/Firefox
128.10 - 128.*
Mozilla/Firefox
138
mozilla/thunderbird
< 128.10.0
mozilla/thunderbird
< 138.0
Mozilla/Thunderbird
128.10 - 128.*
Mozilla/Thunderbird
138
Published
Apr 29, 2025
Tracked Since
Feb 18, 2026