Paper/Archive/CVE-2025-6424

CVE-2025-6424

Mozilla Firefox — Use-after-free in FontFaceSet

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 94.7.947 × 2018.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

Affected

ProductAffectedFixed inSource

Firefoxsee advisory115.25CNA

Thunderbirdsee advisory128.12CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1966423 refmozilla.org/security/advisories/mfsa2025-51 refmozilla.org/security/advisories/mfsa2025-52 refmozilla.org/security/advisories/mfsa2025-53 refmozilla.org/security/advisories/mfsa2025-54 refmozilla.org/security/advisories/mfsa2025-55 reflists.debian.org/debian-lts-announce/2025/07/msg00002.html reflists.debian.org/debian-lts-announce/2025/06/msg00029.html