CVE-2025-1930

AudioIPC StreamData could trigger a use-after-free in the Browser process

View on CVE.org
Published Mar 4, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Analysis

AI-generated

Technical impact

A malformed StreamData sent over AudioIPC from a content process can trigger a use‑after‑free in the Browser process on Windows, which could allow an attacker to escape the browser sandbox and execute code with the Browser’s elevated privileges. The primary impact is a sandbox escape, and the underlying weakness is a use‑after‑free (CWE‑416).

Affected Systems

Mozilla Firefox and Thunderbird running on Windows are affected. The vulnerability is present in all versions before Firefox 136 (or Firefox ESR 115.21/128.8) and before Thunderbird 136 (or Thunderbird ESR 128.8). Upgrading to those patched releases removes the flaw.

Risk and Exploitability

With a CVSS score of 8.8 the issue is classified as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a Windows system where a content process can read audio data, such as a web page or a local file, and inject crafted StreamData that triggers the use‑after‑free in the Browser process.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 136 or newer, or to Firefox ESR 115.21 or 128.8.
  • Upgrade Thunderbird to version 136 or newer, or to Thunderbird ESR 128.8.
  • If an upgrade cannot be performed immediately, configure the browser to restrict or disable audio stream processing from untrusted content to prevent the use‑after‑free trigger.

Generated by OpenCVE AI on April 20, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-6182 On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Title firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process AudioIPC StreamData could trigger a use-after-free in the Browser process
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus
Redhat rhel Tus
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Title firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H'}

threat_severity

Important
Type Values Removed Values Added
Description On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, and Firefox ESR < 128.8. On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
References
Type Values Removed Values Added
Description On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, and Firefox ESR < 128.8.
References
Earlier changes (5)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jun 4, 2026, 2:47 PM
Reserved
Mar 4, 2025, 12:29 PM

View source JSON

Updated
Mar 5, 2025, 4:42 PM

JSON

Status
Modified
Published
Mar 4, 2025, 2:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Important
Public date
Mar 4, 2025, 1:31 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 11:45 PM

JSON