Description
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Published: 2025-02-04
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Use-After-Free (Potential for memory corruption)
Action: Patch Immediately
AI Analysis

Impact

A race condition that occurs during concurrent delazification can trigger a use‑after‑free in the rendering engine. This flaw permits the application to access memory that has already been freed, which could lead to memory corruption or unintended data modification. The vulnerability is classified as a memory‑management defect, identified by CWE‑416.

Affected Systems

Mozilla Firefox versions up to 134 (including all Standard and ESR editions below 115.20 and below 128.7) and Mozilla Thunderbird versions below 128.7 and 135. The affected binaries are also distributed in several Red Hat Enterprise Linux environments, notably versions 8 and 9 and their extended service releases (AUS, EUS, TUS, ELS).

Risk and Exploitability

The CVSS score of 9.8 signals a critical severity. The EPSS score is under 1 %, indicating that exploitation activity has been very low so far, and the vulnerability is not listed in the CISA KEV catalog. The description does not detail a usable exploit or a confirmed attack vector, so the risk remains theoretical but the potential impact would be high if exploited.

Generated by OpenCVE AI on April 22, 2026 at 04:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Firefox 135 or later, or to Firefox ESR 115.20/128.7, and to Thunderbird 128.7 or 135 to apply the fix.
  • If an update is not yet available, keep the browsers at the most recent security‑patched release level and limit exposure by avoiding untrusted web content and disabling questionable extensions.
  • Monitor vendor security advisories for any further patches or related concurrency fixes and apply them promptly.

Generated by OpenCVE AI on April 22, 2026 at 04:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4044-1 firefox-esr security update
Debian DLA Debian DLA DLA-4045-1 thunderbird security update
Debian DSA Debian DSA DSA-5858-1 firefox-esr security update
Debian DSA Debian DSA DSA-5860-1 thunderbird security update
EUVD EUVD EUVD-2025-1967 A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
Ubuntu USN Ubuntu USN USN-7263-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Title firefox: thunderbird: Use-after-free during concurrent delazification Use-after-free during concurrent delazification

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00124}

 epss

{'score': 0.00176}

Thu, 13 Feb 2025 01:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8

Fri, 07 Feb 2025 14:30:00 +0000

Type Values Removed Values Added
Title firefox: thunderbird: Use-after-free during concurrent delazification
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 06 Feb 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Wed, 05 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Feb 2025 14:15:00 +0000

Type Values Removed Values Added
Description A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References

Subscriptions

Mozilla Firefox Thunderbird
Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:25:14.718Z

Reserved: 2025-02-04T07:26:31.830Z

Link: CVE-2025-1012

cve-icon Vulnrichment

Updated: 2025-11-03T20:56:54.541Z

cve-icon NVD

Status : Modified

Published: 2025-02-04T14:15:32.000

Modified: 2026-04-13T15:16:49.693

Link: CVE-2025-1012

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-04T13:58:53Z

Links: CVE-2025-1012 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T04:30:05Z

Weaknesses