Description
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Published: 2025-02-04
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Free Crash
Action: Patch Now
AI Analysis

Impact

An attacker could trigger a use‑after‑free through the Custom Highlight API, which may cause the application to crash. The advisory notes only a potentially exploitable crash, indicating that the primary impact is a loss of availability.

Affected Systems

This flaw affects Mozilla Firefox and Mozilla Thunderbird. Versions earlier than Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135 are vulnerable. The issue is present across all operating systems that host these products, including the Red Hat Enterprise Linux 8, 9, and various maintenance branches listed in the CPE set.

Risk and Exploitability

The CVSS score of 9.8 classifies this weakness as critical, and the EPSS score of less than 1% indicates a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a malicious script, extension, or other user action that triggers the Custom Highlight API, causing the freed memory block to be accessed again. Exact exploitation conditions are not detailed in the advisory, but the severity remains high due to the potential for application crash.

Generated by OpenCVE AI on April 22, 2026 at 07:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch that addresses the use‑after‑free flaw documented under CWE‑416, i.e., upgrade to the latest Firefox 135 or newer, Firefox ESR 115.20 or newer, Firefox ESR 128.7 or newer, Thunderbird 128.7 or newer, or Thunderbird 135 or newer.
  • Disable the Custom Highlight API on affected browsers or configure extensions to avoid using this API, effectively removing the trigger for the CWE‑416 use‑after‑free vulnerability.
  • If disabling the API is not feasible, run Firefox and Thunderbird in a hardened or sandboxed environment and monitor for memory integrity violations, as a precaution against potential exploitation of the CWE‑416 flaw.

Generated by OpenCVE AI on April 22, 2026 at 07:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4044-1 firefox-esr security update
Debian DLA Debian DLA DLA-4045-1 thunderbird security update
Debian DSA Debian DSA DSA-5858-1 firefox-esr security update
Debian DSA Debian DSA DSA-5860-1 thunderbird security update
EUVD EUVD EUVD-2025-1965 An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
Ubuntu USN Ubuntu USN USN-7263-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Title firefox: thunderbird: Use-after-free in Custom Highlight Use-after-free in Custom Highlight

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00124}

 epss

{'score': 0.00176}

Thu, 13 Feb 2025 01:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8

Fri, 07 Feb 2025 14:30:00 +0000

Type Values Removed Values Added
Title firefox: thunderbird: Use-after-free in Custom Highlight
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 06 Feb 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Wed, 05 Feb 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Feb 2025 14:15:00 +0000

Type Values Removed Values Added
Description An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References

Subscriptions

Mozilla Firefox Thunderbird
Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:25:08.956Z

Reserved: 2025-02-04T07:26:27.080Z

Link: CVE-2025-1010

cve-icon Vulnrichment

Updated: 2025-11-03T20:56:48.887Z

cve-icon NVD

Status : Modified

Published: 2025-02-04T14:15:31.767

Modified: 2026-04-13T15:16:49.243

Link: CVE-2025-1010

cve-icon Redhat

Severity : Important

Publid Date: 2025-02-04T13:58:52Z

Links: CVE-2025-1010 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T07:15:11Z

Weaknesses