CVE-2025-13012

A race condition exists in the graphics rendering layer of Mozilla Firefox and Thunderbird that can cause memory corruption or unintended state changes during rendering. The vulnerability is classified as CWE‑362 and CWE‑366. Based on the description, it is inferred that an attacker might exploit this condition to execute arbitrary code by scripting malicious content that triggers rendering.

Affected products include Mozilla Firefox versions prior to 145, including all ESR releases older than 140.5 and 115.30, as well as Mozilla Thunderbird versions prior to 145 and older than 140.5.

The CVSS score of 7.5 indicates a high severity issue. The EPSS score of less than 1 % suggests a low probability of widespread exploitation at present, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most likely attack vector involves delivering malicious content—such as a web page or email—that triggers graphics rendering, potentially allowing local or remote code execution if the race condition is successfully triggered during rendering.