CVE-2025-1009

Use-after-free in XSLT

View on CVE.org
Published Feb 4, 2025 CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Description
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Analysis

AI-generated

Technical impact

A use‑after‑free flaw was found in the XSLT processing engine, allowing an attacker to supply crafted XSLT data that leads to a crash. The flaw is marked as CWE‑416 and could potentially be leveraged to achieve arbitrary code execution, compromising system confidentiality and integrity.

Affected Systems

Mozilla Firefox versions prior to 135, including Firefox ESR 115.20 and 128.7, and all Mozilla Thunderbird releases before 128.7 and 135 are affected. The same flaw may impact Red Hat Enterprise Linux deriving from packages that embed the vulnerable libraries, as indicated by several Red Hat CPE entries.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, and the EPSS score of less than 1% implies low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to trigger the flaw by delivering a malicious XSLT file or URL that is processed by the victim’s browser or email client, making the most probable vector user interaction with crafted content.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to 135 or later, including ESR 115.20 and ESR 128.7.
  • Upgrade Thunderbird to 128.7 or 135.
  • If upgrading immediately is not feasible, configure the browser to block or disable XSLT processing (for example, adjust the about:config setting for XSLT processing) to reduce risk.
  • Disable or remove any extensions or add‑ons that inject or manipulate XSLT content until an update is applied.

Generated by OpenCVE AI on April 20, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4044-1 firefox-esr security update
Debian DLA Debian DLA DLA-4045-1 thunderbird security update
Debian DSA Debian DSA DSA-5858-1 firefox-esr security update
Debian DSA Debian DSA DSA-5860-1 thunderbird security update
EUVD EUVD EUVD-2025-1964 An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
Ubuntu USN Ubuntu USN USN-7263-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Title firefox: thunderbird: Use-after-free in XSLT Use-after-free in XSLT
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00196}

 epss

{'score': 0.00277}
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
Type Values Removed Values Added
Title firefox: thunderbird: Use-after-free in XSLT
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References
Earlier changes (4)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:25 PM
Reserved
Feb 4, 2025, 7:26 AM

View source JSON

Updated
Nov 3, 2025, 8:56 PM

JSON

Status
Modified
Published
Feb 4, 2025, 2:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Important
Public date
Feb 4, 2025, 1:58 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 6:45 PM

JSON