Paper/Archive/CVE-2025-1010

CVE-2025-1010

Mozilla Firefox — Use-after-free in Custom Highlight

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 40.2.402 × 208.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory115.20CNA

Thunderbirdsee advisory128.7CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1936982 refmozilla.org/security/advisories/mfsa2025-07 refmozilla.org/security/advisories/mfsa2025-08 refmozilla.org/security/advisories/mfsa2025-09 refmozilla.org/security/advisories/mfsa2025-10 refmozilla.org/security/advisories/mfsa2025-11 reflists.debian.org/debian-lts-announce/2025/02/msg00006.html reflists.debian.org/debian-lts-announce/2025/02/msg00005.html